php-mod/curl allows Cross-site Scripting

MEDIO 6.1CVE-2021-30134 · GHSA-f8p3-q834-q9cj · Published 26/12/2022 · updated 17/06/2026

In breve

CVE-2021-30134 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda php-mod/curl, ht slider range for amazon affiliates (ht slider range for amazon affiliates project), php curl class (php curl class project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 71.1% delle vulnerabilità.
Correzione: aggiornare a 2.3.2, 1.1.6, 3.0.3, 2.1.0 o successiva.

Package	Affected versions	Patched versions
php-mod/curl Packagist	`< 2.3.2`	`2.3.2`
ht slider range for amazon affiliates ht_slider_range_for_amazon_affiliates_project	`< 1.1.6`	`1.1.6`
php curl class php_curl_class_project	`< 2.3.2`	`2.3.2`
invoicing with invoicexpress for woocommerce ptwooplugins	`< 3.0.3`	`3.0.3`
woo-qiwi-payment-gateway qiwi	`≤ 0.0.9`	No fix yet
shopello api shopello_api_project	`≤ 2.9.0`	No fix yet
teamleader crm forms teamleade	`< 2.1.0`	`2.1.0`

Description

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

NVD description

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

References

nvd.nist.gov/vuln/detail/CVE-2021-30134 · ADVISORY
php-mod/curl commit 0bddefe · WEB
php-mod/curl · PACKAGE
wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2021-30134 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda php-mod/curl, ht slider range for amazon affiliates (ht slider range for amazon affiliates project), php curl class (php curl class project).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 71.1% delle vulnerabilità.

Correzione: aggiornare a 2.3.2, 1.1.6, 3.0.3, 2.1.0 o successiva.

Package

Affected versions

Patched versions

php-mod/curl

Packagist

< 2.3.2

2.3.2

ht slider range for amazon affiliates

ht_slider_range_for_amazon_affiliates_project

< 1.1.6

1.1.6

php curl class

php_curl_class_project

< 2.3.2

2.3.2

invoicing with invoicexpress for woocommerce

ptwooplugins

< 3.0.3

3.0.3

woo-qiwi-payment-gateway

qiwi

≤ 0.0.9

No fix yet

shopello api

shopello_api_project

≤ 2.9.0

No fix yet

teamleader crm forms

teamleade

< 2.1.0

2.1.0

Description

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

NVD description

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.