Nguyen Van Khanh

3 exploits Active since Mar 2021
CVE-2021-24155 NOMISEC HIGH WORKING POC
Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload via SGBP Import
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
10 stars
CVSS 7.2
CVE-2021-24155 METASPLOIT HIGH ruby WORKING POC
Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload via SGBP Import
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
CVSS 7.2
CVE-2021-24145 METASPLOIT HIGH ruby WORKING POC
Modern Events Calendar Lite < 5.16.5 - Arbitrary File Upload via CSV Import
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
CVSS 7.2