CRITICAL🇵🇱 Wersja polska

CVE-2023-4666

CVSS 9.8v3.1pub. 2023-10-16upd. 2025-04-23

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • 10web Form Maker

    APP
    10Web
    < 1.15.20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References

Related vulnerabilities

CVE-2019-10866CRITICAL9.8ten sam produkt

In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function g...

CVE-2024-43220HIGH7.1ten sam produkt

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 1...

CVE-2023-45071HIGH7.1ten sam produkt

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobil...

CVE-2023-45070HIGH7.1ten sam produkt

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mo...

CVE-2022-3300HIGH7.2ten sam produkt

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter befor...