CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5630 – Insert or Embed Articulate Content into WordPress < 4.3000000024 - Author+ Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2024-5630
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. El complemento Insert or Embed Articulate Content into de WordPress anterior a 4.3000000024 no impide que los autores carguen archivos arbitrarios al sitio, lo que puede permitirles cargar shells PHP en los sitios afectados. The Insert or Embed Articulate Content into WordPress plugin for WordPress is vulnerable to arbitrary file uploads through insecure file uploads in a zip archive in all versions up to, and including, 4.3000000023. This makes it possible for unauthenticated attackers to upload zip files containing phar files on the affected site's server which may make remote code execution possible. CVE-2024-0757 is likely a duplicate of this issue. • https://wpscan.com/vulnerability/538c875f-4c20-4be0-8098-5bddb7aecff4 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2024-0757 – Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE
https://notcve.org/view.php?id=CVE-2024-0757
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files El complemento Insert or Embed Articulate Content en WordPress hasta 4.3000000023 no filtra correctamente qué extensiones de archivo pueden importarse en el servidor, lo que permite cargar código malicioso dentro de archivos zip. The Insert or Embed Articulate Content into WordPress plugin for WordPress is vulnerable to arbitrary file uploads through insecure file uploads in a zip archive in all versions up to, and including, 4.3000000023. This makes it possible for unauthenticated attackers to upload zip files containing phar files on the affected site's server which may make remote code execution possible. • https://github.com/hunThubSpace/CVE-2024-0757-Exploit https://wpscan.com/vulnerability/eccd017c-e442-46b6-b5e6-aec7bbd5f836 • CWE-434: Unrestricted Upload of File with Dangerous Type •