CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24312 – WP Super Cache < 1.7.3 - Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-24312
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209. Los parámetros $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages usados en la configuración del plugin WP Super Cache de WordPress versiones anteriores a 1.7.3 resultan en RCE porque permiten la entrada de "$" y "\n". Esto es debido a una corrección incompleta de CVE-2021-24209 • https://wpscan.com/vulnerability/2142c3d3-9a7f-4e3c-8776-d469a355d62f • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24329 – WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24329
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue. El plugin WP Super Cache WordPress versiones anteriores a 1.7.3, no saneababa apropiadamente su parámetro wp_cache_location en su configuración, lo que podría conllevar a no saneababa correctamenteun problema de tipo Cross-Site Scripting almacenados The Twitter Bootstrap Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_cache_location' parameter in versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://m0ze.ru/vulnerability/%5B2021-03-23%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Super-Cache-WordPress-Plugin-v1.7.2.txt https://wpscan.com/vulnerability/9df86d05-1408-4c22-af55-5e3d44249fd0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24209 – WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2021-24209
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection. El plugin WordPress WP Super Cache versiones anteriores a 1.7.2, estuvo afectado por una RCE autenticado (admin+) en la página de configuración debido a una falta de comprobación de entrada y una comprobación débil de $cache_path en la opción WP Super Cache Settings-) Cache Location. El acceso directo al archivo wp-cache-config.php no está prohibido, por lo que esta vulnerabilidad puede ser explotada para una inyección de shell web • https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache https://wpscan.com/vulnerability/733d8a02-0d44-4b78-bbb2-37e447acd2f3 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 96%CPEs: 2EXPL: 3CVE-2013-2010 – W3 Total Cache <= 0.9.2.8 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2013-2010
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability WordPress W3 Total Cache Plugin versión 0.9.2.8, presenta una Vulnerabilidad de Ejecución de Código PHP Remota. • https://www.exploit-db.com/exploits/25137 http://packetstormsecurity.com/files/130999/WordPress-W3-Total-Cache-PHP-Code-Execution.html http://www.exploit-db.com/exploits/25137 http://www.openwall.com/lists/oss-security/2013/04/24/9 http://www.securityfocus.com/bid/59316 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 5%CPEs: 1EXPL: 3CVE-2013-2009 – WP Super Cache <= 1.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2013-2009
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution WordPress WP Super Cache Plugin versión 1.2, presenta una Ejecución de Código PHP Remota. The WP Super Cache plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.2. This allows unauthenticated attackers to execute code on the server. • https://www.exploit-db.com/exploits/38494 http://www.openwall.com/lists/oss-security/2013/04/24/10 http://www.openwall.com/lists/oss-security/2013/04/24/12 http://www.openwall.com/lists/oss-security/2013/04/24/8 http://www.securityfocus.com/bid/59470 https://exchange.xforce.ibmcloud.com/vulnerabilities/83799 • CWE-94: Improper Control of Generation of Code ('Code Injection') •