CVE-2023-2745

MEDIUM Year: 2023
CVSS v3 Score
6.1
Medium
Weakness Type
CWE-22
View all →

Vulnerability Description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Related Vulnerabilities

CVE-2021-20133

MEDIUM
CVSS:6.1(Medium)

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of th...

CWE-222021

CVE-2016-7116

MEDIUM
CVSS:6.0(Medium)

Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified st...

CWE-222016

CVE-2017-8189

MEDIUM
CVSS:6.0(Medium)

FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may exploit this vulnerability to cover some files...

CWE-222017

CVE-2021-21908

MEDIUM
CVSS:6.0(Medium)

Specially-crafted command line arguments can lead to arbitrary file deletion. The handle_delete function does not attempt to sanitize or otherwise validate the contents of the [file] parameter (passed...

CWE-222021

CVE-2021-21909

MEDIUM
CVSS:6.0(Medium)

Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command. An attacker can provide malicious inputs to trigger this vulnerability

CWE-222021

CVE-2023-33310

MEDIUM
CVSS:6.0(Medium)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n...

CWE-222023