dzs-zoomsounds 漏洞

严重CVE-2021-44492024/10/16

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

dzs-zoomsoundsPoC 已收录

CVSS9.8

低危2023/10/20

WordPress Plugin dzs zoomsounds

Searches for sensitive directories present in the dzs-zoomsounds plugin.

dzs-zoomsoundsPoC 已收录

CVSS—

高危CVE-2021-393162021/08/31

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.

dzs-zoomsoundsPoC 已收录

CVSS7.5EPSS 90.7%

dzs-zoomsounds

关联漏洞

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

WordPress Plugin dzs zoomsounds

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion