CVE-2024-10098

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

CVSS 2.7 LOWEPSS 0.3%

Vexday Risk Score

8Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 2.7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

15 mai 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

Unknown · ApplyOnline

Referências

https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/