Vulnerabilities

TI-2024-04591 CVE-2024-4936 · GHSA-w55j-394j-qgr9

Canto <= 3.0.8 - Unauthenticated Remote File Inclusion

MEDIUM 51

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01027 Published 2024-06-14 No fix listed CWE-98

TI-2024-16553 CVE-2024-25096 · GHSA-5rcw-5rq5-g5x2

WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability

MEDIUM 50

Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00681 Published 2024-04-03 No fix listed CWE-94

TI-2023-03224 CVE-2023-3452 · GHSA-r7j9-2qv5-fpm9

Canto <= 3.0.4 - Unauthenticated Remote File Inclusion

MEDIUM 59

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06958 Published 2023-08-12 No fix listed CWE-98

TI-2022-19142 CVE-2022-40305 · GHSA-c7qc-fwv2-h5hv

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to…

MEDIUM 45

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01575 Published 2022-09-09 No fix listed CWE-918

TI-2020-17501 CVE-2020-28978 · GHSA-425j-2mfw-73xx

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.

MEDIUM 40

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.15431 Published 2020-11-30 No fix listed CWE-918

TI-2020-17500 CVE-2020-28977 · GHSA-5vmw-6f78-pj9m

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.

MEDIUM 40

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.15431 Published 2020-11-30 No fix listed CWE-918

TI-2020-17499 CVE-2020-28976 · GHSA-cm65-67cq-fq4v

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.

MEDIUM 46

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.27771 Published 2020-11-30 No fix listed CWE-918

TI-2020-14792 CVE-2020-24063 · GHSA-9f2v-7rwv-4q3w

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.

LOW 35

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01464 Published 2020-11-10 No fix listed CWE-918

TI-2013-06071 CVE-2013-7416 · GHSA-pg8j-phhv-cggg

canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to…

LOW 38

canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02846 Published 2014-12-03 No fix listed CWE-77

Vulnerabilities

Filters