Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
Vulnerability Description
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
CVSS Information
N/A
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
WordPress plugin Import any XML or CSV File to WordPress 路径遍历漏洞
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Import any XML or CSV File to WordPress 存在路径遍历漏洞，该漏洞源于未验证上传的 zip 存档中包含的文件的路径，从而允许高特权的用户（例如管理员）将任意文件写入 Web 服务器可通过路
CVSS Information
N/A
Vulnerability Type
N/A