Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Workeera 1.0.6 Clear all filters
TI-2026-53802 CVE-2026-77018 · GHSA-gwhh-3rfp-872r

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

Priority MEDIUM 41

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0073 Published 2026-08-27 Fixed in 1.0.6 CWE-434
TI-2026-53801 CVE-2026-77017 · GHSA-gmqc-8f92-w42j

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

Priority LOW 34

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00429 Published 2026-08-27 Fixed in 1.0.6 CWE-200
TI-2026-53800 CVE-2026-77016 · GHSA-wfmx-7744-w3xf

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

Priority MEDIUM 42

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00434 Published 2026-08-27 Fixed in 1.0.6 CWE-73