CVE-2015-6668

high · 7.5

The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.

7.5

CVSS

10.0%

EPSS (exploit prob.)

95th

EPSS percentile

2017-10-19

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
wp-jobmanager	job_manager	<= 0.7.24

Check a specific version with /api/v1/cve/match.

References

https://vagmour.eu/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin/
https://wpvulndb.com/vulnerabilities/8167
https://vagmour.eu/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin/
https://wpvulndb.com/vulnerabilities/8167

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-6668