HIGH🇵🇱 Wersja polska

CVE-2016-9484

CVSS 7.5v3.0pub. 2018-07-13upd. 2024-11-21

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Jqueryform PHP Formmail Generator

    APP
    Jqueryform
    < 2016-12-06
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalAuth Bypass
CWE
References

Related vulnerabilities

CVE-2016-9482CRITICAL9.8PL ✓same product

Auth Bypass w kodzie generowanym przez PHP FormMail Generator

CVE-2016-9483CRITICAL9.8PL ✓same product

PHP FormMail Generator — deserializacja niezaufanych danych umożliwia RCE

CVE-2016-9492CRITICAL9.8PL ✓same product

Nieograniczony upload niebezpiecznych plików w PHP FormMail Generator

CVE-2016-9493MEDIUM6.1same product

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scri...

CVE-2022-24984CRITICAL9.8PL ✓same vendor

JQueryForm: nieuwierzytelniony upload pliku i RCE przez bypass walidacji