zingiri vulnerabilities

Products

• zingiri web shop 2
• forums 1
• theme tuner plugin 1

Latest zingiri CVEs

Newest publication first

1. CVE-2012-4920 Forums < 1.4.4 - Directory Traversal

   Published 2014-04-04

   Medium·CVSS 5.0 EPSS 3.3%

   Directory traversal vulnerability in the zing_forum_output function in forum.php in the Zingiri Forum (aka Forums) plugin before 1.4.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter to index.php.

2. CVE-2012-6506 Zingiri Web Shop Plugin <= 2.4.1 - Cross-Site Scripting

   Published 2013-01-24

   Medium·CVSS 4.3 EPSS 5.3% Public exploit

   Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.

3. CVE-2012-4033 Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities

   Published 2012-07-18

   High·CVSS 10.0 EPSS 2.6%

   Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.

4. CVE-2012-0934 Theme Tuner < 0.8 - Remote File Inclusion

   Published 2012-01-29

   High·CVSS 7.5 EPSS 8.1%

   PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.