Filemanagerpro File_manager
14 CVEs affecting Filemanagerpro File_manager. Latest disclosed: 2024-10-16. Critical: 2, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25213 | Critical | 10.0 | 2020-09-09 | The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsaf… |
CVE-2018-25105 | Critical | 9.8 | 2024-10-16 | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and… |
CVE-2024-8507 | High | 8.8 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or in… |
CVE-2024-1538 | High | 8.8 | 2024-03-21 | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorr… |
CVE-2023-6846 | High | 8.8 | 2024-02-05 | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_s… |
CVE-2018-16966 | High | 8.8 | 2019-04-15 | There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. |
CVE-2024-0761 | High | 8.1 | 2024-02-05 | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomnes… |
CVE-2024-8746 | High | 7.5 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_fol… |
CVE-2020-24312 | High | 7.5 | 2020-08-26 | mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability fo… |
CVE-2024-8918 | High | 7.4 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of… |
CVE-2024-2654 | Medium | 6.8 | 2024-04-09 | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Thi… |
CVE-2018-16967 | Medium | 6.1 | 2019-04-15 | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. |
CVE-2021-24177 | Medium | 5.4 | 2021-04-05 | In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manage… |
CVE-2018-16363 | Medium | 5.4 | 2018-09-07 | The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transie… |