Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Saturday Drive Component: Ninja Forms File Uploads Clear all filters
TI-2022-00792 CVE-2022-0888 · GHSA-6g4g-f39p-q93f

Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload

Priority HIGH 69

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.39393 Published 2022-03-23 No fix listed CWE-434
TI-2022-00793 CVE-2022-0889 · GHSA-fvgm-c3gh-jgmj

Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting

Priority LOW 33

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php f…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00776 Published 2022-03-23 No fix listed CWE-79