جزئیات آسیب‌پذیری
CVE-2025-30996
Themify BloggieThemify PhotoboxThemify RezoThemify SlideThemify EdminThemify Folo
Arbitrary File Upload Vulnerability in WordPress themes by Themify
CVSS 3.1
9.9بحرانی
شرح رسمی (انگلیسی)
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.9بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (Patchstack) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Themify | Bloggie | v ≤ 2.0.8 | CVEProject cvelistV5 (CNA) |
| Themify | Photobox | v ≤ 2.0.1 | CVEProject cvelistV5 (CNA) |
| Themify | Rezo | v ≤ 1.9.7 | CVEProject cvelistV5 (CNA) |
| Themify | Slide | v ≤ 1.7.5 | CVEProject cvelistV5 (CNA) |
| Themify | Themify Edmin | v ≤ 2.0.0 | CVEProject cvelistV5 (CNA) |
| Themify | Themify Folo | v ≤ 1.9.6 | CVEProject cvelistV5 (CNA) |
| Themify | Themify Newsy | v ≤ 1.9.9 | CVEProject cvelistV5 (CNA) |
| Themify | Themify Sidepane WordPress Theme | v ≤ 1.9.8 | CVEProject cvelistV5 (CNA) |
| Themify | Wigi | v ≤ 2.0.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۹- https://patchstack.com/database/wordpress/theme/sidepane/vulnerability/wordpress-themify-sidepane-wordpress-theme-1-9-8-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/folo/vulnerability/wordpress-themify-folo-1-9-6-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/edmin/vulnerability/wordpress-themify-edmin-2-0-0-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/photobox/vulnerability/wordpress-photobox-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/wigi/vulnerability/wordpress-wigi-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/rezo/vulnerability/wordpress-rezo-1-9-7-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/wordpress/theme/slide/vulnerability/wordpress-slide-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۰/۱۷
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۲/۰۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Patchstack
پیش‌بینی بهره‌برداری (EPSS)
۰٫۵٪
احتمال بهره‌برداری در ۳۰ روز
۴۳٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type