IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-03-23 06:16

MODIFIED

2026-03-23 06:16

EPSS (Prob. Exploit)

0.30%

Top 77.4%

DATA SOURCES:

NVD 🔗 2026-03-23 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05

> DESCRIPTION

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7pqw-9j4j-h8q3 HIGH

extract-zip allows arbitrary file writes through symlink archive entries

AFFECTED PACKAGES:

NPM / extract-zip

<= 2.0.1

> HISTORIQUE DES MODIFICATIONS

Première apparition

23/03/2026 06:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 7 months ago

> REFERENCES