Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Ffw Component: Omgf Clear all filters
TI-2021-06922 CVE-2021-24639 · GHSA-9w5p-x556-4j8v

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

Priority LOW 37

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00912 Published 2021-09-20 Fixed in 4.5.4 CWE-22
TI-2021-06921 CVE-2021-24638 · GHSA-728f-qcc4-8q48

OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API

Priority MEDIUM 43

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01821 Published 2021-09-20 Fixed in 4.5.4 CWE-22