CVSS: 7.8EPSS: 83%CPEs: 1EXPL: 3CVE-2024-12849 – Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read
https://notcve.org/view.php?id=CVE-2024-12849
06 Jan 2025 — The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. El complemento Error Log Viewer de WP Guru para WordPress es vulnerable a la lectura arbitraria de archivos en todas las versiones hasta la 1.0.1.3 incluida a través de la ... • https://packetstorm.news/files/id/183360 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6821 – Error Log Viewer < 1.1.3 - Directory Listing to Sensitive Data Exposure
https://notcve.org/view.php?id=CVE-2023-6821
20 Feb 2024 — The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 contains a vulnerability that allows you to read and download PHP logs without authorization El complemento Error Log Viewer de BestWebSoft WordPress anterior a 1.1.3 contiene una vulnerabilidad que le permite leer y descargar registros PHP sin autorización The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP logs without authorization The Error Log... • https://wpscan.com/vulnerability/6b1a998d-c97c-4305-b12a-69e29408ebd9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24761 – Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF
https://notcve.org/view.php?id=CVE-2021-24761
29 Dec 2021 — The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. El plugin de WordPress Error Log Viewer anterior a la versión 1.1.2 no realiza la comprobación de nonce al eliminar un archivo de registro y no tiene prevención de path traversal, lo que podría permitir a los atacantes hacer que un administrador conectado elimi... • https://wpscan.com/vulnerability/c14e1ba6-fc00-4150-b541-0d6740fee4d2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 7%CPEs: 1EXPL: 3CVE-2021-24966 – Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
https://notcve.org/view.php?id=CVE-2021-24966
10 Nov 2021 — The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder El plugin Error Log Viewer de WordPress versiones hasta 1.1.1, no comprueba la ruta del archivo de registro que va a ser borrada, permitiendo a usuarios con altos privilegios borrar archivos arbitrarios en el servidor web, incluidos los que están fuera de la carpeta del blog WordPress Erro... • https://packetstorm.news/files/id/165985 • CWE-73: External Control of File Name or Path •
CVSS: 6.1EPSS: 0%CPEs: 51EXPL: 0CVE-2017-2171
https://notcve.org/view.php?id=CVE-2017-2171
22 May 2017 — Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Post... • http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18562 – Error Log Viewer by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18562
17 Apr 2017 — The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. El plugin de error-log-viewer anterior a la versión 1.0.6 para WordPress tiene múltiples problemas de XSS. The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, 1.0.6 due to insufficient input sanitization and output escaping on the 'category' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a vict... • https://wordpress.org/plugins/error-log-viewer/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •