MetaSlider up to 3.106.0 builds a PHP include path from the theme folder and version stored in a slideshow's settings without sanitizing them, and checks imported theme images only by MIME type. A user with Editor access can plant a payload file and point a slideshow's theme at it through path traversal, leading to remote code execution. This... Weiterlesen: Remote Code Execution in MetaSlider Theme Loading
Intelligence View
⚡ tsecurity.de Intelligence
Remote Code Execution in MetaSlider Theme Loading
MetaSlider up to 3.106.0 builds a PHP include path from the theme folder and version stored in a slideshow's settings without sanitizing them, and checks…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
13 Quellen
CVE-2026-110893 | Brainstorm Force SureDash Plugin up to 1.12.2 on WordPress authorization (EUVD-2026-108057)
12 weitere Quellen
VVulDB Updatesvor 1 Std.CVE-2026-114698 | myCred Plugin up to 4.0.0-beta.1 on WordPress authorization (EUVD-2026-108055) VVulDB Updatesvor 1 Std.CVE-2026-110894 | Brainstorm Force SureDash Plugin up to 1.12.2 on WordPress missing authentication (EUVD-2026-108056) VVulDB Updatesvor 1 Std.CVE-2026-112327 | TMS Amelia Plugin up to 2.4.11 on WordPress sql injection (EUVD-2026-108054) VVulDB Updatesvor 3 Std.CVE-2026-114182 | IdeaBox Creations PowerPack Addons Plugin up to 3.1.0 on WordPress missing authentication (EUVD-2026-108034) VVulDB Updatesvor 3 Std.CVE-2026-111847 | Kings Plugins MarketKing Plugin up to 2.1.72 on WordPress authorization (EUVD-2026-108030) VVulDB Updatesvor 3 Std.CVE-2026-112826 | eLightUp Falcon Plugin up to 2.12.0 on WordPress authorization (EUVD-2026-108032)
+6
11 Quellen
CVE-2026-96357 | Drupal Webform Module up to 6.2.11/6.3.0 cross site scripting (WID-SEC-2026-3554)
10 weitere Quellen
VVulDB Updatesvor 2 Std.CVE-2026-96356 | Drupal Webform Plugin up to 6.2.12/6.3.0-6.3.1 improper authorization (WID-SEC-2026-3554) VVulDB Updatesvor 2 Std.CVE-2026-96355 | Drupal Webform up to 6.2.11/6.3.0 neutralization (WID-SEC-2026-3554) VVulDB Updatesvor 2 Std.CVE-2026-96358 | Drupal Webform up to 6.2.11/6.3.0 cross site scripting (WID-SEC-2026-3554) VVulDB Updatesvor 2 Std.CVE-2026-96359 | Drupal Webform up to 6.2.11/6.3.0 cross site scripting (WID-SEC-2026-3554) VVulDB Updatesvor 2 Std.CVE-2026-96360 | Drupal Webform up to 6.2.11/6.3.0 cross site scripting (WID-SEC-2026-3554) VVulDB Updatesvor 1 Std.CVE-2026-112845 | Jory Hogeveen Off-Canvas Sidebars & Menus Plugin up to 0.5.9 on WordPress cross site scripting (EUVD-2026-108058)
+4
10 Quellen
CVE-2026-70183 | Microsoft ASP.NET Core/Visual Studio race condition (Nessus ID 370204)
9 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2026-70186 | Microsoft ASP.NET Core/Visual Studio deadlock (Nessus ID 370204) VVulDB Updatesvor 3 Std.CVE-2026-88092 | Microsoft ASP.NET Core Kestrel request smuggling (Nessus ID 370204) VVulDB Updatesvor 3 Std.CVE-2026-70188 | Microsoft ASP.NET Core/Visual Studio response splitting (Nessus ID 370204) VVulDB Updatesvor 3 Std.CVE-2026-70196 | Microsoft ASP.NET Core/Visual Studio resource consumption (Nessus ID 370204) VVulDB Updatesvor 4 Std.CVE-2026-102870 | Microsoft ASP.NET Core/Visual Studio code injection (Nessus ID 370204) VVulDB Updatesvor 4 Std.CVE-2026-58280 | Microsoft .NET/.NET Framework/Visual Studio recursion (Nessus ID 370204)
+3
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4287771/sicherheitsluecken-cve/remote-code-execution-in-metaslider-theme-loading/