cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-10480,https://securityvulnerability.io/vulnerability/CVE-2024-10480,CSRF Flaw in Popular WordPress Plugin Exposes Administrative Settings,"CVE-2024-10480 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting the 3DPrint Lite WordPress plugin prior to version 2.1. This flaw allows malicious actors to leverage a CSRF attack to manipulate configuration settings without the owner’s consent, provided they are logged in as an administrator. The absence of adequate CSRF verification makes it possible for attackers to exploit this security gap, potentially leading to unauthorized changes that could compromise the security of the WordPress site.",Wordpress,3dprint Lite,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-12-06T06:00:07.090Z,0
CVE-2021-4436,https://securityvulnerability.io/vulnerability/CVE-2021-4436,Unauthorized File Upload Vulnerability in 3DPrint Lite WordPress Plugin,"The 3DPrint Lite plugin for WordPress, when used in versions prior to 1.9.1.5, is susceptible to a file upload vulnerability due to a lack of proper authorization checks in its AJAX action p3dlite_handle_upload. This inadequacy allows unauthenticated users to upload potentially malicious files to the server. Although there are .htaccess rules in place intended to restrict access to these files on servers such as Apache, the risk of uploading unauthorized files could still pose serious security threats to the integrity of the web environment.",Wordpress,3dprint Lite,9.8,CRITICAL,0.02304000034928322,false,,false,false,true,true,false,false,2024-02-05T09:02:44.634Z,0
CVE-2022-3899,https://securityvulnerability.io/vulnerability/CVE-2022-3899,3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF,"The 3dprint WordPress plugin, specifically in versions prior to 3.5.6.9, contains a vulnerability that exposes it to Cross-Site Request Forgery (CSRF) attacks. This flaw exists in the modified Tiny File Manager included with the plugin. An attacker can exploit this vulnerability by creating a malicious request that, when executed by an authenticated admin user, allows file or directory deletion on the target server. This poses a serious risk to website integrity and data security, as it can lead to unauthorized access to critical files.",Wordpress,3dprint,8.1,HIGH,0.0006000000284984708,false,,false,false,true,true,false,false,2024-01-16T15:50:51.026Z,0
CVE-2022-4023,https://securityvulnerability.io/vulnerability/CVE-2022-4023,3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad,"The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.",Wordpress,3dprint,5.3,MEDIUM,0.0020600000862032175,false,,false,false,false,,false,false,2023-07-17T13:29:47.733Z,0