Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
366 results · page 5 of 8
Mar 21, 2024File Manager: Cross-Site Request ForgeryCVE-2024-1538 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
- Product
- File Manager
- Affected
- up to 7.2.4
- What to do
- Affects up to 7.2.4. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 17, 2024Frontend File Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7.
- Product
- Frontend File Manager
- Affected
- up to 22.7
- What to do
- Affects up to 22.7. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024File Manager Pro: Reflected Cross-Site ScriptingCVE-2023-7015 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- File Manager Pro
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfilemanagerpro.iowordfence.com
Mar 13, 2024The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) CVE-2023-6825 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable. The Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, which could lead to this vulnerability being exploited by lower-level users.
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 28, 2024Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.CVE-2023-52047 · Other software · dedecms · reported by MITREHigh 8.8
Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024File Manager: Sensitive Information ExposureCVE-2024-0761 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
- Product
- File Manager
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 5, 2024File Manager Pro: Arbitrary File UploadCVE-2023-6846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.
- Product
- File Manager Pro
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordfence.com
Jan 16, 20243dprint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-3899 · WordPress plugins & themes · reported by WPScanHigh 8.1
The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.
- Product
- 3dprint
- Fixed in
- 3.5.6.9
- What to do
- Update 3dprint to 3.5.6.9 or newer.
Dec 20, 2023Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-40204 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
- Product
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: Deserialization of Untrusted DataCVE-2022-47599 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
- Product
- File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 11, 2023File Manager: Does not restrict the file managers root directoryCVE-2023-5907 · WordPress plugins & themes · reported by WPScanMedium 6.5
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
- Product
- File Manager
- Fixed in
- 6.3
- What to do
- Update File Manager to 6.3 or newer.
Dec 4, 2023Frontend File Manager: Has a vulnerability that allows an Editor+ user to bypass the file download logic and download files suchCVE-2023-5105 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
- Product
- Frontend File Manager
- Fixed in
- 22.6
- What to do
- Update Frontend File Manager to 22.6 or newer.
Oct 16, 2023File Manager Pro: Does not adequately validate and escape some inputsCVE-2023-4862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 16, 2023File Manager Pro: Allows admin users to upload arbitrary filesCVE-2023-4861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 16, 2023File Manager Pro: Does not properly check the CSRF nonce in the `fs_connector` AJAX actionCVE-2023-4827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
- Product
- File Manager Pro
- Fixed in
- 1.8
- What to do
- Update File Manager Pro to 1.8 or newer.
Oct 2, 2023File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.CVE-2023-44008 · Other software · Mojoportal · reported by MITRECritical 9.8
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting aCVE-2023-40983 · Other software · Webmin · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting aCVE-2023-40984 · Other software · Webmin · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41162 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask field while searching under the tools drop down.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023 Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows CVE-2023-4480 · Websites & servers · PHPFusion · reported by disclosure@synopsys.comMedium 5.5
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.
- Product
- PHPFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Sep 4, 2023Advanced File Manager: Does not adequately authorize its usage on multisite installationsCVE-2023-3814 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
- Product
- Advanced File Manager
- Fixed in
- 5.1.1
- What to do
- Update Advanced File Manager to 5.1.1 or newer.
Aug 30, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41163 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrCVE-2023-24517 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 6.4
Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.compandorafms.com
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
- Product
- 3DPrint
- Fixed in
- 3.5.6.9
- What to do
- Update 3DPrint to 3.5.6.9 or newer.
Jun 27, 2023File Manager Advanced Shortcode: Does not adequately prevent uploading files with disallowed MIME typesCVE-2023-2068 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
- Product
- File Manager Advanced Shortcode
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 6, 2023Frontend File Manager: Unauthenticated Content InjectionCVE-2021-4369 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to edit the content and title of every page on the site.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Authenticated Settings ChangeCVE-2021-4368 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Stored Cross-Site ScriptingCVE-2021-4365 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Arbitrary Post DeletionCVE-2021-4359 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2.CVE-2021-4356 · WordPress plugins & themes · reported by WordfenceCritical 9
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover.
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Post Meta ChangeCVE-2021-4351 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Frontend File Manager: Unauthenticated HTML InjectionCVE-2021-4350 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Frontend File Manager: Privilege EscalationCVE-2021-4344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling the use of user IDs that is accessible by the visitor. This makes it possible for unauthenticated or authenticated attackers to access the information and privileges of other users, including 'guest users', in their own category (authenticated, or unauthenticated guests).
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Mar 21, 2023Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compeCVE-2023-27842 · Other software · Extplorer · reported by MITREHigh 8.8
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent
- Product
- Extplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.tristaomarinho.comextplorer.net
Dec 6, 2022Kodexplorer is a chinese language web based file manager and browser based code editor.CVE-2022-46154 · Other software · kalcaddle · reported by GitHubHigh 8.6
Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download.CVE-2022-45476 · Other software · Prasathmani · reported by help@fluidattacks.comCritical 9.8
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 25, 2022Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files.CVE-2022-45475 · Other software · Prasathmani · reported by help@fluidattacks.comMedium 6.5
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 25, 2022Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application.CVE-2022-23044 · Other software · Prasathmani · reported by help@fluidattacks.comHigh 8.8
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF.
- Product
- Tiny File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 17, 2022Frontend File Manager: Does not have CSRF checkCVE-2022-3126 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf
- Product
- Frontend File Manager
- Fixed in
- 21.4
- What to do
- Update Frontend File Manager to 21.4 or newer.
Oct 3, 2022Frontend File Manager: Allows any authenticated usersCVE-2022-3125 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Oct 3, 2022Frontend File Manager: Allows any unauthenticated user to rename uploaded files from usersCVE-2022-3124 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Sep 12, 2022Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.CVE-2022-38296 · Other software · Cuppacms · reported by MITRECritical 9.8
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2022Frontend File Manager & Sharing: Does not filter file extensionsCVE-2022-2356 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
- Product
- Frontend File Manager & Sharing
- Fixed in
- 1.1.3
- What to do
- Update Frontend File Manager & Sharing to 1.1.3 or newer.
Jul 26, 2022Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct CVE-2022-1496 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 26, 2022Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images dCVE-2022-1648 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 5.7
Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.comincibe.es
Jul 25, 2022In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting.CVE-2022-2032 · Other software · Artica PFMS · reported by cve-coordination@incibe.esLow 3.5
In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.comincibe.es
Jul 22, 2022Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to CVE-2022-1141 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user gesture.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jun 23, 2022A vulnerability was found in File Manager Plugin 3.0.1.CVE-2017-20091 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely.
- Product
- File Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32162 · Other software · Webmin · reported by MITREHigh 8.8
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32161 · Other software · Webmin · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.