Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:37:38 +0000 bdu:2021-03855 https://cve.radiocsirt.org/vuln/bdu:2021-03855 bdu:2021-03855 https://cve.radiocsirt.org/vuln/bdu:2021-03855 EUVD-2026-23665 https://cve.radiocsirt.org/vuln/euvd-2026-23665 EUVD-2026-23665 https://cve.radiocsirt.org/vuln/euvd-2026-23665 fkie_cve-2021-24252 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24252 <p>The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)</p> <p>The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-24252 GHSA-4r26-734p-358q https://cve.radiocsirt.org/vuln/ghsa-4r26-734p-358q <p>The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)</p> <p>The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)</p> https://cve.radiocsirt.org/vuln/ghsa-4r26-734p-358q gsd-2021-24252 https://cve.radiocsirt.org/vuln/gsd-2021-24252 gsd-2021-24252 https://cve.radiocsirt.org/vuln/gsd-2021-24252