CVE-2012-2920

Опубликовано: 21 мая 2012

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:user_photo:user_photo:*:*:*:*:*:*:*:*

Версия до 0.9.5 (включая)

cpe:2.3:a:user_photo:user_photo:0.7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.7.1:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.7.2:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.7.3:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.7.4:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.7.4b:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.0.2:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.0.3:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.0.4:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.0.5:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.8.1:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.9:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.9.1:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.9.2:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.9.3:*:*:*:*:*:*:*

cpe:2.3:a:user_photo:user_photo:0.9.4:*:*:*:*:*:*:*

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00324

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-j9r4-8gpw-9hh6

github

около 3 лет назад