Vendor archive

ffw CVEs

Beta · best-effort

3 CVEs tagged to vendor ffw — 1 Critical, 1 High, 1 Medium, 0 Low, 0 Unrated.

See this archive with more filters View vendor evidence profile Explore

CVE-2021-25021

Published Jan 3, 2022

The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and…

CVSS 4.9 · Medium

Vendor/product tagsBeta · best-effort

CVE-2021-24639

Published Sep 20, 2021

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users…

CVSS 8.1 · High

Vendor/product tagsBeta · best-effort

CVE-2021-24638

Published Sep 20, 2021

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite…

CVSS 9.1 · Critical

Vendor/product tagsBeta · best-effort

Showing 1-3 of 3 CVEsPage 1 of 1