amtythumb project vulnerabilities

Products

• amtythumb 2

Latest amtythumb project CVEs

Newest publication first

1. CVE-2022-1683 amtyThumb <= 4.2.0 - Subscriber+ SQLi

   Published 2022-06-06

   High·CVSS 8.8 EPSS 1.5%

   The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to th...

2. CVE-2017-17059 amtyThumb posts <= 8.2.0 - Cross-Site Scripting

   Published 2017-11-29

   Medium·CVSS 6.1 EPSS 3.4%

   XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.