« Volver al listado

CVE-2012-1010

Estado: ModificadaAlta (7.5)—

Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Likno — Allwebmenus Plugin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-1010",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-02-07T21:55:04.250",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/47659",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18407",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/51615",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72640",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/47659",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18407",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/51615",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72640",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Subida de ficheros sin restricción en actions.php en el complemento AllWebMenus antes de v1.1.8 para WordPress, permite a atacantes remotos ejecutar código PHP de su elección subiendo un archivo ZIP que contenga el archivo PHP y accediendo a este a través de una petición directa al archivo en un directorio no especificado."
    }
  ],
  "lastModified": "2026-06-16T23:38:47.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40D02700-CA22-4326-BE85-FFB014BF722C",
              "versionEndIncluding": "1.1.7"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6996004-21F8-4261-81DA-C91E38E657FF"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A996F53-7122-4F06-8AC8-9DAB4047D6B9"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF7EDEB6-B70F-49BB-AA7D-3A4C07D878CC"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2950A27D-477E-49C3-BF69-E1597D30B37B"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "099D2A66-AA14-4BF9-A130-8239488FD7C7"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B74FD70-505F-498C-905F-F0CA238BA2FA"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17FCD4FC-3579-47FA-B114-2FC76FB2BF31"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE145B19-80A8-48FC-9177-694823B42C1F"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B310AB7-204F-4CA0-A0AB-8C7F578DF726"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA11EDF0-52F9-474F-A4A0-759383679176"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68F51D2D-D525-4893-81DB-1A12BA4A1497"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B4030BF-41CD-40E3-8FB9-BFA8B7E7D5C8"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E7C690E-360A-4662-BF1C-FCE0E23AEB83"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5F238F4-63E9-4417-BECC-D44CFF38E7EB"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.0.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A732E139-B375-47D5-8EAC-3C2821B9067D"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A78F6F15-32DE-42DB-B45E-FC580048340E"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA65E81E-17D3-4206-B9F4-65913427CB1C"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB679CB0-35E7-42EB-9014-81BB75C624D8"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C78156C-7D10-4B34-925A-10A82A29FCE3"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D31A9692-1A83-4F9D-B153-12F6F9151DB4"
            },
            {
              "criteria": "cpe:2.3:a:likno:allwebmenus_plugin:1.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CFAD42A-D78D-43E6-8462-CAD782C12F7E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "847DA578-4655-477E-8A6F-99FBE738E4F9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}