Phastpress
Approved changes feed: RSS · Atom
cpe:2.3:a:kiboit:phastpress:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Kiboit (36fad957-0508-510d-bd57-b48f489828fe) |
|---|---|
| Product | Phastpress (c8f9341d-dc6b-5a84-8e7e-3a7d65687722) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/apeschar/phastpress |
purl2cpe | 2026-06-01 10:11:28.561177 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3712 |
vulnerable | 2026-11-03 10:16:37.817393 |
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
HIGH (7.3)
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
Published: 2026-10-15T04:26:50.177Z
Updated: 2026-10-15T16:43:45.173Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14388 |
vulnerable | 2026-06-08 07:06:34.385446 |
PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection
CRITICAL (9.8)
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
Published: 2025-12-23T09:20:03.420Z
Updated: 2026-04-08T17:31:49.693Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.