CVE

Id
93988  
CVE No.
CVE-2016-7168  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.  
Phase
Assigned (20160908)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
795261 93988 CVE-2016-7168 MLIST:[oss-security] 20160908 Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names  View
795262 93988 CVE-2016-7168 URL:http://www.openwall.com/lists/oss-security/2016/09/08/19  View
795263 93988 CVE-2016-7168 MLIST:[oss-security] 20160908 Re: Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names  View
795264 93988 CVE-2016-7168 URL:http://www.openwall.com/lists/oss-security/2016/09/08/24  View
795265 93988 CVE-2016-7168 MISC:https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerability_in_wordpress_due_to_unsafe_processing_of_file_names.html  View
795266 93988 CVE-2016-7168 CONFIRM:https://codex.wordpress.org/Version_4.6.1  View
795267 93988 CVE-2016-7168 CONFIRM:https://github.com/WordPress/WordPress/commit/c9e60dab176635d4bfaaf431c0ea891e4726d6e0  View
795268 93988 CVE-2016-7168 CONFIRM:https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/  View
795269 93988 CVE-2016-7168 BID:92841  View

Related JVN