Tournamatch vulnerabilities
2 known vulnerabilities in Tournamatch from Tournamatch. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest first
- 9.6 Critical severity
Tournamatch: External Control of File Name or Path
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the
- 7.1 High severity
Tournamatch: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS.This issue affects Tournamatch: from n/a through <= 4.7.0.