CVE-2021-24349

Katalog CVE

CVSS 6.1 · Medium EPSS 0,41%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gallery from files project gallery from files. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.

Rincian

Terbit di NVD

14 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/6bb4eb71-d702-4732-b01f-b723077d66ca exploit · advisory pihak ketiga