CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24761 – Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF
https://notcve.org/view.php?id=CVE-2021-24761
29 Dec 2021 — The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. El plugin de WordPress Error Log Viewer anterior a la versión 1.1.2 no realiza la comprobación de nonce al eliminar un archivo de registro y no tiene prevención de path traversal, lo que podría permitir a los atacantes hacer que un administrador conectado elimi... • https://wpscan.com/vulnerability/c14e1ba6-fc00-4150-b541-0d6740fee4d2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 7%CPEs: 1EXPL: 3CVE-2021-24966 – Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
https://notcve.org/view.php?id=CVE-2021-24966
10 Nov 2021 — The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder El plugin Error Log Viewer de WordPress versiones hasta 1.1.1, no comprueba la ruta del archivo de registro que va a ser borrada, permitiendo a usuarios con altos privilegios borrar archivos arbitrarios en el servidor web, incluidos los que están fuera de la carpeta del blog WordPress Erro... • https://packetstorm.news/files/id/165985 • CWE-73: External Control of File Name or Path •
CVSS: 6.1EPSS: 0%CPEs: 51EXPL: 0CVE-2017-2171
https://notcve.org/view.php?id=CVE-2017-2171
22 May 2017 — Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Post... • http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18562 – Error Log Viewer by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18562
17 Apr 2017 — The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. El plugin de error-log-viewer anterior a la versión 1.0.6 para WordPress tiene múltiples problemas de XSS. The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, 1.0.6 due to insufficient input sanitization and output escaping on the 'category' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a vict... • https://wordpress.org/plugins/error-log-viewer/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •