CVE-2021-24223

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Unrestricted Upload of File with Dangerous Type pada n5 upload form project n5 upload form. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial.

Rincian

Terbit di NVD

12 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jinhuang1102/CVE-ID-Reports/blob/12863f80ced5361e2e2c3f7209566ab3730aa37b/N5_upload.md exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/d7a72183-0cd1-45de-b98b-2e295b27e5db exploit · advisory pihak ketiga