NVD

Id
21692  
Name
CVE-2016-7168  
Description
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.  
Reject
 
CVSS Version
2  
CVSS Score
3.5  
Severity
Low  
CVSS Base Score
3.5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:N/I:P/A:N)  
Pub Date
2017-07-18  
Published
2017-01-04  
Modified Date
2017-07-17  
Seq
2016-7168  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
116651 21692 CVE-2016-7168 [oss-security] 20160908 Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names  View
116652 21692 CVE-2016-7168 [oss-security] 20160908 Re: Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names  View
116653 21692 CVE-2016-7168 92841  View
116654 21692 CVE-2016-7168 https://codex.wordpress.org/Version_4.6.1  View
116655 21692 CVE-2016-7168 https://github.com/WordPress/WordPress/commit/c9e60dab176635d4bfaaf431c0ea891e4726d6e0  View
116656 21692 CVE-2016-7168 https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerability_in_wordpress_due_to_unsafe_processing_of_file_names.html  View
116657 21692 CVE-2016-7168 https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/  View

Related JVN