Search for vulnerabilities
Vulnerability ID | VCID-8j6w-s38j-6fbd |
Aliases |
CVE-2018-20149
|
Summary | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. |
Status | Published |
Exploitability | 0.5 |
Weighted Severity | 4.9 |
Risk | 2.5 |
Affected and Fixed Packages | Package Details |
Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Percentile | 0.83481 |
EPSS Score | 0.02111 |
Published At | Aug. 1, 2025, 12:55 p.m. |
Date | Actor | Action | Source | VulnerableCode Version |
---|---|---|---|---|
2025-07-31T09:59:31.623696+00:00 | NVD Importer | Import | https://nvd.nist.gov/vuln/detail/CVE-2018-20149 | 37.0.0 |