CVE-2024-7863
Favicon Generator < 2.1 - Arbitrary File Upload via CSRF
- State
- Published
- Severity
- 8.1 High
- Published
- Sep 13, 2024
- Updated
- Sep 13, 2024
- Reserved
- Aug 15, 2024
Description
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Favicon Generator (CLOSED)Unknown |
|
References
- https://wpscan.com/vulnerability/5e814b02-3870-4742-905d-ec03b0d31add/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.