Contus Video Comments Vulnerabilities

[en] Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Oct 6, 2016

CVE-2016-1000112 on NVD →

The Contus Video Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS:

9.8

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Jun 22, 2016

CVE-2016-1000112 on NVD →

The Contus Video Comments plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the file_put_contents function in versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload .jpg images anywhere in the WordPress installation.

CVSS:

5.3

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Jun 15, 2016

The Contus Video Comments plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the file_put_contents function in versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload .jpg images anywhere in the WordPress installation.

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Jun 15, 2016

The contus-video-comments WordPress plugin was affected by an Unauthenticated Remote JPG File Upload security vulnerability.

Affected:

up to 1.0

Fix:

No patched version reported