Логотип exploitDog
bind:CVE-2018-20148
Консоль
Логотип exploitDog

exploitDog

bind:CVE-2018-20148

Количество 4

Количество 4

ubuntu логотип

CVE-2018-20148

больше 6 лет назад

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
EPSS: Средний
nvd логотип

CVE-2018-20148

больше 6 лет назад

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
EPSS: Средний
debian логотип

CVE-2018-20148

больше 6 лет назад

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could con ...

CVSS3: 9.8
EPSS: Средний
github логотип

GHSA-jgj7-cghf-2wq9

около 3 лет назад

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
EPSS: Средний

Уязвимостей на страницу

Уязвимость
CVSS
EPSS
Опубликовано
ubuntu логотип
CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
46%
Средний
больше 6 лет назад
nvd логотип
CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
46%
Средний
больше 6 лет назад
debian логотип
CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could con ...

CVSS3: 9.8
46%
Средний
больше 6 лет назад
github логотип
GHSA-jgj7-cghf-2wq9

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

CVSS3: 9.8
46%
Средний
около 3 лет назад

Уязвимостей на страницу