https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:16:55 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-86368 cnvd-2022-86368 https://cve.radiocsirt.org/vuln/cnvd-2022-86368 https://cve.radiocsirt.org/vuln/euvd-2026-286110 EUVD-2026-286110 https://cve.radiocsirt.org/vuln/euvd-2026-286110 https://cve.radiocsirt.org/vuln/fkie_cve-2022-3361 <p>The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the &#39;template&#39; attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.</p> <p>The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the &#39;template&#39; attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-3361 https://cve.radiocsirt.org/vuln/ghsa-q6cc-3x9h-cxmm <p>The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the &#39;template&#39; attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.</p> <p>The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the &#39;template&#39; attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.</p> https://cve.radiocsirt.org/vuln/ghsa-q6cc-3x9h-cxmm https://cve.radiocsirt.org/vuln/gsd-2022-3361 gsd-2022-3361 https://cve.radiocsirt.org/vuln/gsd-2022-3361