CVE-2016-1000156

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mailcwp remote file upload vulnerability incomplete fix v1.100

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Dec 14, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-100027.5Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3CVE-2016-10002138.8Ruckus Wireless H500 web management interface CSRFCVE-2016-10002145.3Ruckus Wireless H500 web management interface authentication bypassCVE-2016-10002157.5Ruckus Wireless H500 web management interface denial of serviceCVE-2016-10002168.8Ruckus Wireless H500 web management interface authenticated command injectionCVE-2016-10002179.8Zotpress plugin for WordPress SQLi in zp_get_account()CVE-2016-10002188.8Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports wheCVE-2016-10002197.5Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the CVE-2016-10002206.1Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browseCVE-2016-10002217.5Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive infoCVE-2016-10002227.5Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.CVE-2016-10002296.1swagger-ui has XSS in key names
CVE-2016-1000156: Critical severity, CVSS 9.8 | Vulnix