CVE-2022-0595
published 2022-03-28CVE-2022-0595: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action…
PriorityP340medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EXPLOIT
EPSS
13.58%
96.0th percentile
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codedropz | drag_and_drop_multiple_file_upload_contact_form_7 | < 1.3.6.3 | 1.3.6.3 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
nuclei·CVSS 5.4
CVE-2022-0595 [MEDIUM] WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
WordPress Contact Form 7
-----------------------------92633278134516118923780781161--
- |
GET /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/{{randstr}}.svg HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'contains(body_2, "alert(document.domain)")'
- 'status_code_2 == 200'
condition: and
# digest: 4a0a0047304502202f4bcd82ececc09384b4cfe4e71e31fddf6318dbb42bec6d5b6d77bae143ad820221008b295b0235784dd48544586cd75bacccc1c7827e0eb498509070fab29ccb12b7:922c64590222798bb761d5b6d8e72950
Greynoiseio
NoiseLetter January 2025
blogs_greynoiseio
NoiseLetter January 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2022-24834 redis: heap overflow in the lua cjson and cmsgpack libraries
bugzilla·2023-07-10·CVSS 8.8
CVE-2022-24834 [HIGH] CVE-2022-24834 redis: heap overflow in the lua cjson and cmsgpack libraries
CVE-2022-24834 redis: heap overflow in the lua cjson and cmsgpack libraries
CVE-2022-24834 - A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users.
https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
Discussion:
Created redis tracking bugs for this issue:
Affects: epel-all [bug 2222024]
Affects: fedora-all [bug 2222025]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2025:0595 https://access.redhat.com/errata/RHSA-2025:0595
---
This issue has b
2022-03-28
Published