CVE-2015-10138

NGHIÊM TRỌNG 9.8CVE-2015-10138 · Công bố 19/07/2025 · cập nhật 27/07/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
work the flow file upload lyntonreed	`≤ 2.5.2`	Chưa có bản vá

Mô tả

The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Tham khảo

packetstormsecurity.com/files/131294 · Exploit
packetstormsecurity.com/files/131512 · Exploit
plugins.trac.wordpress.org/changeset · Patch
plugins.trac.wordpress.org/changeset · Patch
wpscan.com/vulnerability/a49a81a9-3d4b-4c8d-b719-fc513aceecc6 · Third Party Advisory
acunetix.com/vulnerabilities/web/wordpress-plugin-work-the-flow-file-upload-arbitrary-file-upload-2-5-2 · Third Party Advisory
homelab.it/index.php/2015/04/04/wordpress-work-the-flow-file-upload-vulnerability · Exploit
rapid7.com/db/modules/exploit/unix/webapp/wp_worktheflow_upload · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/eb271cc8-01ec-45eb-9d6f-efc55c7c3923 · Third Party Advisory

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí