CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
Explanation of Vulnerability in Simple Terms
Users Control versions up to 1.0.16 contain a path traversal vulnerability that allows an attacker to read or write arbitrary files on the server. The vulnerability requires user interaction—the victim must click a malicious link or visit a crafted page. An attacker can access sensitive files, modify site content, or potentially execute code depending on file permissions.
What an attacker can do
Read or write arbitrary files on the server, potentially exposing sensitive data or modifying site files.
Potential impact on your site
Attackers could steal configuration files, database credentials, or modify core site files without needing a user account.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
