backupbuddy 漏洞

中危CVE-2022-48972023/01/25

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

backupbuddyPoC 已收录

CVSS6.1EPSS 13.1%

高危CVE-2022-314742022/09/07

BackupBuddy - Local File Inclusion

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters.

backupbuddyPoC 已收录RCE

CVSS7.5EPSS 92.4%

backupbuddy

关联漏洞

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

BackupBuddy - Local File Inclusion