CVSS: 9.8EPSS: 1%CPEs: 23EXPL: 3CVE-2012-1010 – AllWebMenus WordPress Menu Plugin < 1.1.9 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-1010
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. Subida de ficheros sin restricción en actions.php en el complemento AllWebMenus antes de v1.1.8 para WordPress, permite a atacantes remotos ejecutar código PHP de su elección subiendo un archivo ZIP que contenga el archivo PHP y accediendo a este a través de una petición directa al archivo en un directorio no especificado. Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. • https://www.exploit-db.com/exploits/18407 http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html http://secunia.com/advisories/47659 http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog http://www.exploit-db.com/exploits/18407 http://www.securityfocus.com/bid/51615 https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 2CVE-2011-3981 – AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2011-3981
PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. Vulnerabilidad de inclusión de PHP remoto en actions.php en el plugin AllWebMenus v1.1.3 para WordPress. Permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro abspath. • https://www.exploit-db.com/exploits/17861 http://plugins.trac.wordpress.org/changeset/438959/allwebmenus-wordpress-menu-plugin/trunk/actions.php?old=408304&old_path=allwebmenus-wordpress-menu-plugin%2Ftrunk%2Factions.php http://secunia.com/advisories/46068 http://www.exploit-db.com/exploits/17861 http://www.securityfocus.com/bid/49685 https://exchange.xforce.ibmcloud.com/vulnerabilities/69929 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •