Advisories · Technology
uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin.
Every CVE that names uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Broken access control
- CVSS 8.1 High
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Insecure deserialization
- CVSS 7.2 High
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Unrestricted file upload
- CVSS 6.4 Medium
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Insecure deserialization
- CVSS 8.8 High
Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Broken access control
- CVSS 5.5 Medium
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
- uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- Server-side request forgery (SSRF)