CVE-2022-1391

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.

9.8

CVSS

15.1%

EPSS (exploit prob.)

97th

EPSS percentile

2022-04-25

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
kanev	cab_fare_calculator	< 1.0.4

Check a specific version with /api/v1/cve/match.

References

https://packetstormsecurity.com/files/166533/
https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac
https://packetstormsecurity.com/files/166533/
https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-1391