Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Awesome Support 6.1.5 Clear all filters
TI-2023-04928 CVE-2023-5355 · GHSA-x85w-8f7w-627g

Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion

Priority HIGH 68

The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0083 Published 2023-11-06 Fixed in 6.1.5 CWE-22
TI-2023-04925 CVE-2023-5352 · GHSA-x748-g8vm-gmhw

Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply

Priority MEDIUM 53

The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00486 Published 2023-11-06 Fixed in 6.1.5 CWE-683
TI-2023-04927 CVE-2023-5354 · GHSA-cr99-wv2g-phxw

Awesome Support < 6.1.5 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege use…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00461 Published 2023-11-06 Fixed in 6.1.5 CWE-79