CVE-2021-24684

October 22, 2021

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.

Summary:

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.

Reference Links(if available):

  • https://wpscan.com/vulnerability/b5295bf9-8cf6-416e-b215-074742a5fc63

  • CVSS Score (if available)

    v2: / MEDIUMAV:N/AC:L/Au:S/C:C/I:C/A:C

    v3: / HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Links to Exploits(if available)

  • You may have missed

    image

    [MEOW] – Ransomware Victim: Zyloware

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Cottles Asphalt Maintenance Inc

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Karl Malone Toyota

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Pine Belt Cars

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: J[.]S[.]T[.] Espana

    November 14, 2024