Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24857

ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown ToTop Link

  • 1.7.1 to ≤ 1.7.1affected

References