CVE-2020-36705

CRITICAL EXPLOITED NUCLEI

Adning Advertising < 1.5.5 - Unauthenticated Arbitrary File Upload via _ning_upload_image Function

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-36705 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Nuclei Templates (1)

Adning Advertising <= 1.5.5 - Arbitrary File Upload
CRITICALVERIFIEDby DhiyaneshDK

References (5)

Core 5

Scores

CVSS v3 9.8
EPSS 0.0694
EPSS Percentile 93.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2020-07-07
CWE
CWE-434
Status published
Products (2)
tunafish/Adning Advertising < 1.5.5
tunasite/adning_advertising < 1.5.6
Published Jun 07, 2023
Tracked Since Feb 18, 2026