How severe is CVE-2018-8711?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2018-8711?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2018-8711

CRITICAL Year: 2018

CVSS v3 Score

9.8

Critical

CVSS v2 Score

7.5

High

Weakness Type

CWE-20

View all →

Vulnerability Description

A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.

CVE-2002-2444

CRITICAL

CVSS:9.8(Critical)

Snoopy before 2.0.0 has a security hole in exec cURL

CWE-202002

CVE-2009-4488

CRITICAL

CVSS:9.8(Critical)

Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2009-4491

CRITICAL

CVSS:9.8(Critical)

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2010-0748

CRITICAL

CVSS:9.8(Critical)

Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.

CWE-202010