CVE-2021-24642
Assigner: WPScan
Published: 2021-10-18T13:45:52
State: PUBLISHED
affected: product: Scroll Baner
vendor: Unknown
versions: lessThanOrEqual: 1.0
status: affected
version: 1.0
versionType: custom
credits: value: Chuang Li
descriptions: value: The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
source: discovery: EXTERNAL
title: Scroll Baner <= 1.0 - CSRF to RCE
x_generator: WPScan CVE Generator