CVEブラウザに戻る

CVE-2020-36705

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1620%

EPSS Percentile22.55th

Published2023年6月7日

Last Modified2026年4月8日

Vulnerability Description

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected Platforms (CPE)

📦

Tunasite

Adning Advertising

< 1.5.6

References & Advisories

🔗 https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/

🔗 https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693

🔗 https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c

🔗 https://www.wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin/

🔗 https://www.wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982?source=cve

🔗 https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/

🔗 https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693

🔗 https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c

関連する脆弱性情報

CVE-2020-367286.5

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1....

CVE-2020-1189610.0

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

CVE-2020-1189710.0

The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.

CVE-2020-202110.0

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option i...