PT-2026-39481 · Unknown · Amministrazione Aperta

Published 2026-05-10 · Updated 2026-05-10 · CVE-2022-50956

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions amministrazione-aperta version 3.7.3

Description Insufficient input validation in the open parameter allows unauthenticated attackers to read arbitrary files. By supplying file paths through the open GET parameter in the 'dispatcher.php' endpoint, an attacker can include and read sensitive files accessible to the web server.

Recommendations As a temporary workaround, restrict access to the 'dispatcher.php' endpoint or avoid using the open parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-50956

Affected Products

Amministrazione Aperta

References · 5

• 🔥 https://exploit-db.com/exploits/50838 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50956 · Security Note
• https://vulncheck.com/advisories/wordpress-plugin-amministrazione-aperta-local-file-read · Note
• https://twitter.com/CVEnew/status/2053537460458758216 · Twitter Post
• https://wordpress.org/plugins/amministrazione-aperta · Note