cbcvebase.
CVE-2010-5293
published 2014-01-21

CVE-2010-5293: wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass…

PriorityP431medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
2.53%
83.1th percentile
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.

Affected

52 ranges· showing 25
VendorProductVersion rangeFixed in
debianwordpress< wordpress 3.0.2-1 (bookworm)wordpress 3.0.2-1 (bookworm)
wordpresswordpress<= 3.0.1—
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——
wordpresswordpress——

CVSS provenance

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.