CVE-2022-0493

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04944.4A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows CVE-2022-04959.4The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vuln CVE-2022-04965.5A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-o CVE-2022-04977.1A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annot CVE-2022-04998.8The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th CVE-2022-05007.8A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF CVE-2022-05016.1Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.CVE-2022-05025.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-05036.1The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting CVE-2022-05046.5Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05056.5Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05065.4Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.