Canto vulnerabilities
We track 4 vulnerabilities in Canto products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 14, 2024.
Latest Canto vulnerabilities
- 9.8 Critical severity
Canto: Improper Control of Filename for Include/Require Statement in PHP Program
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution
- 9.8 Critical severity
Canto: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
- 9.8 Critical severity
Canto: Improper Control of Filename for Include/Require Statement in PHP Program
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_
- 9.8 Critical severity
Canto: Server-Side Request Forgery
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form.