Vendors / Canto Inc. Records 9 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 2
Exploited now Canto Inc. records in CISA KEV No Canto Inc. vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 59
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06958 · Published 2023-08-12 · No fix listed CWE-98
Priority MEDIUM 51
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01027 · Published 2024-06-14 · No fix listed CWE-98
Priority MEDIUM 50
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00681 · Published 2024-04-03 · No fix listed CWE-94
Priority MEDIUM 46
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.27771 · Published 2020-11-30 · No fix listed CWE-918
Priority MEDIUM 45
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to t…
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01575 · Published 2022-09-09 · No fix listed CWE-918
Priority MEDIUM 40
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.15431 · Published 2020-11-30 · No fix listed CWE-918
Priority MEDIUM 40
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.15431 · Published 2020-11-30 · No fix listed CWE-918
Priority LOW 38
canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.
CVSS 2.0 HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02846 · Published 2014-12-03 · No fix listed CWE-77
Priority LOW 35
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
CVSS 3.1 HIGH 7.2· Network · No auth · No interaction · EPSS 0.01464 · Published 2020-11-10 · No fix listed CWE-918
Open these records in search → All records by CVSS severity
4 2 3 0 0
THREATIST.IORead the docs