Search criteria
2 vulnerabilities found for wp-curriculo_vitae_free by williamluis
CVE-2021-24222 (GCVE-0-2021-24222)
Vulnerability from nvd – Published: 2021-04-12 14:03 – Updated: 2024-08-03 19:21
VLAI
Title
WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE
Summary
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.
Severity
No CVSS data available.
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/4d715de6-8595-4d… | x_refsource_CONFIRM |
| https://github.com/jinhuang1102/CVE-ID-Reports/bl… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | WP-Curriculo Vitae Free |
Affected:
6.3 , ≤ 6.3
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:21:18.724Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WP-Curriculo Vitae Free",
"vendor": "Unknown",
"versions": [
{
"lessThanOrEqual": "6.3",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jin Huang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-12T14:03:34.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "WP-Curricul Vitea Free \u003c= 6.3 - Unauthenticated Arbitrary File Upload to RCE",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24222",
"STATE": "PUBLIC",
"TITLE": "WP-Curricul Vitea Free \u003c= 6.3 - Unauthenticated Arbitrary File Upload to RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WP-Curriculo Vitae Free",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.3",
"version_value": "6.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jin Huang"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900",
"refsource": "CONFIRM",
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"name": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md",
"refsource": "MISC",
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24222",
"datePublished": "2021-04-12T14:03:34.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:21:18.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24222 (GCVE-0-2021-24222)
Vulnerability from cvelistv5 – Published: 2021-04-12 14:03 – Updated: 2024-08-03 19:21
VLAI
Title
WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE
Summary
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.
Severity
No CVSS data available.
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/4d715de6-8595-4d… | x_refsource_CONFIRM |
| https://github.com/jinhuang1102/CVE-ID-Reports/bl… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | WP-Curriculo Vitae Free |
Affected:
6.3 , ≤ 6.3
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:21:18.724Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WP-Curriculo Vitae Free",
"vendor": "Unknown",
"versions": [
{
"lessThanOrEqual": "6.3",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jin Huang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-12T14:03:34.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "WP-Curricul Vitea Free \u003c= 6.3 - Unauthenticated Arbitrary File Upload to RCE",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24222",
"STATE": "PUBLIC",
"TITLE": "WP-Curricul Vitea Free \u003c= 6.3 - Unauthenticated Arbitrary File Upload to RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WP-Curriculo Vitae Free",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.3",
"version_value": "6.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jin Huang"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900",
"refsource": "CONFIRM",
"url": "https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900"
},
{
"name": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md",
"refsource": "MISC",
"url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24222",
"datePublished": "2021-04-12T14:03:34.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:21:18.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}