CVE-2023-5241

HIGH Year: 2023
CVSS v3 Score
8.1
High
Weakness Type
CWE-22
View all →

Vulnerability Description

The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.

Related Vulnerabilities

CVE-2007-5927

HIGH
CVSS:8.1(High)

Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. (dot dot) in the first argument to the GlobalLog sto...

CWE-222007

CVE-2008-5748

HIGH
CVSS:8.1(High)

Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the (1) lang, (2) theme, and (3) module parameters.

CWE-222008

CVE-2009-4194

HIGH
CVSS:8.1(High)

Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions allows remote authenticated users to delete arbitrary files via a .. (dot dot) in t...

CWE-222009

CVE-2016-1671

HIGH
CVSS:8.1(High)

Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/esca...

CWE-222016

CVE-2017-16929

HIGH
CVSS:8.1(High)

The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a rem...

CWE-222017

CVE-2017-18585

HIGH
CVSS:8.1(High)

The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

CWE-222017