Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for Secure Custom Fields by Unknown

    CVE-2024-9529 (GCVE-0-2024-9529)

    Vulnerability from nvd – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
    VLAI
    Title
    Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
    Summary
    The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
    Severity
    6.6 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Secure Custom Fields Affected: 6.3.7 , < 6.3.9 (semver)
    		Create a notification for this product.
    Unknown Secure Custom Fields Affected: 0 , < 6.3.6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3.9 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3.6.3 (semver)
    Affected: 6.3.7 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Automattic Security Team WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.6.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "6.3.7",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T18:32:21.308252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T18:38:37.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "6.3.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Automattic Security Team"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T06:00:08.369Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-9529",
    "datePublished": "2024-11-15T06:00:08.369Z",
    "dateReserved": "2024-10-04T15:01:44.589Z",
    "dateUpdated": "2024-11-15T18:38:37.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-9529 (GCVE-0-2024-9529)

    Vulnerability from cvelistv5 – Published: 2024-11-15 06:00 – Updated: 2024-11-15 18:38
    VLAI
    Title
    Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
    Summary
    The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
    Severity
    6.6 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/dd3cc8d8-4dff-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Secure Custom Fields Affected: 6.3.7 , < 6.3.9 (semver)
    		Create a notification for this product.
    Unknown Secure Custom Fields Affected: 0 , < 6.3.6.3 (semver)
    		Create a notification for this product.
    Unknown Advanced Custom Fields Pro Affected: 0 , < 6.3.9 (semver)
    		Create a notification for this product.
    wpengine advanced_custom_field_pro Affected: 0 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    wpengine advanced_custom_fields Affected: 0 , < 6.3.6.3 (semver)
    Affected: 6.3.7 , < 6.3.9 (semver)
        cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Automattic Security Team WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_field_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_field_pro",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:wpengine:advanced_custom_fields:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "advanced_custom_fields",
            "vendor": "wpengine",
            "versions": [
              {
                "lessThan": "6.3.6.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "6.3.9",
                "status": "affected",
                "version": "6.3.7",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T18:32:21.308252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T18:38:37.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "6.3.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Custom Fields",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Automattic Security Team"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T06:00:08.369Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secure Custom Fields \u003c 6.3.6.3 - Admin+ Remote Code Execution",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-9529",
    "datePublished": "2024-11-15T06:00:08.369Z",
    "dateReserved": "2024-10-04T15:01:44.589Z",
    "dateUpdated": "2024-11-15T18:38:37.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}