PT-2025-3923 · Unknown · Multivendorx

Michael Mazzolini

+1

·

Published

2025-01-31

·

Updated

2025-05-23

·

CVE-2025-0493

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MultiVendorX plugin versions up to 4.2.14
Description The issue allows unauthenticated attackers to include PHP files on the server via the tabname parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
Recommendations For MultiVendorX plugin versions up to 4.2.14, update the plugin to a version later than 4.2.14 to resolve the issue. As a temporary workaround, consider restricting access to the tabname parameter to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-0493

Affected Products

Multivendorx