CVE-2020-36705

CRITIQUE 9.8CVE-2020-36705 · Published 07/06/2023 · updated 17/06/2026

En bref

CVE-2020-36705 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant adning advertising (tunasite).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 6.9%, plus élevée que 94.1% des vulnérabilités.
Correctif : mettre à jour vers 1.5.6 ou plus récent.

Package	Affected versions	Patched versions
adning advertising tunasite	`< 1.5.6`	`1.5.6`

Description

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

References

blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild · Third Party Advisory
codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693 · Product
wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c · Third Party Advisory
wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin · Exploit
wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982 · Third Party Advisory

Autres vulnérabilités de adning advertising

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

adning advertising

tunasite

< 1.5.6

1.5.6

Description