How severe is CVE-2023-5199?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.8 out of 10.

What type of vulnerability is CVE-2023-5199?

This is classified as CWE-552, which is a common weakness in software security.

CVE-2023-5199 - HIGH Severity | CVSS 8.8

Vulnerability Description

The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.

Related Vulnerabilities

CVE-2021-20182

HIGH

CVSS:8.8(High)

A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to th...

CWE-5522021

CVE-2021-4112

HIGH

CVSS:8.8(High)

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user ...

CWE-5522021

CVE-2022-25297

HIGH

CVSS:8.8(High)

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations o...

CWE-5522022

CVE-2022-32143

HIGH

CVSS:8.8(High)

In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller on...

CWE-5522022

CVE-2022-42234

HIGH

CVSS:8.8(High)

There is a file inclusion vulnerability in the template management module in UCMS 1.6

CWE-5522022

CVE-2023-20235

HIGH

CVSS:8.8(High)

A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to...

CWE-5522023