smsaexpress vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.6	EPSS 0.5%	CVE-2024-49249SMSA Shipping (WordPress plugin) · Path Traversal: '.../...// High8.6EPSS 0.5%2025-01-07CVE Database V5CVE-2024-49249 Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3. EPSS 0.5%Vulnerability SMSA Express	CVE Database V5	2025-01-07
High	8.8	EPSS 0.9%	CVE-2024-12066SMSA Shipping (official) (WordPress plugin) · External Control of File Name or Path High8.8EPSS 0.9%2024-12-21CVE Database V5CVE-2024-12066 The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue. EPSS 0.9%Vulnerability smsaexpress CWE-73	CVE Database V5	2024-12-21

Page 1 of 1