Web: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1390

April 25, 2022, 4:16 p.m. |

National Vulnerability Database nist.gov

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique

cve

Mid-Level Research Cyber Security Engineer (Hybrid options available)

@ Riverside Research | Beavercreek, Ohio

Security Intelligence Manager, Incident Response

@ Atlassian | Sydney, Australia

Security Consultant, Professional Services

@ Amazon.com | Seoul, KOR

Senior Cybersecurity Architect

@ Lucayan Technology Solutions LLC | Tampa, Florida, United States

Application Security Engineer

@ PlayStation Global | United States, San Francisco, CA

Security Engineer I, Offensive Security Penetration Testing

@ Amazon.com | US, TX, Virtual Location - Texas

Cyber Security Engineer

@ GWA Group | Derrimut, Victoria, Australia

Threat Intelligence Consultant- Remote (Anywhere in the U.S.)

@ GuidePoint Security LLC | Remote

Senior Cloud Security Engineer

@ Reddit | Atlanta, GA

Information Security Officer

@ Vix Technology | Cambridge, England, United Kingdom

Information Security Manager (12m FTC)

@ PlayStation Global | United Kingdom, London

Vulnerability Management Engineer (Qualys)

@ Aperia | Dallas, Texas, United States - Remote