CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through <= 1.10.
Explanation of Vulnerability in Simple Terms
DigiWidgets Image Editor versions 1.10 and earlier contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary code on affected sites over the network without user interaction. The vulnerability stems from improper handling of user-supplied input, enabling attackers to inject and execute malicious code. This affects confidentiality, integrity, and availability of the entire system.
What an attacker can do
Run arbitrary code on the site and take complete control of it.
Potential impact on your site
Complete compromise of the site, data theft, malware installation, and service disruption.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
