CVE-2016-0796

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Improper Authentication pada mb.miniaudioplayer project mb.miniaudioplayer. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.

Rincian

Terbit di NVD

28 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.vapidlabs.com/advisory.php?v=162 exploit · advisory pihak ketiga
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mb-miniaudioplayer-an-html5-audio-player-for-you... exploit · advisory pihak ketiga