CVE-2024-37224 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP… |
CVE-2024-3749 | Medium | 6.5 | 2024-05-15 | The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongin… |
CVE-2024-3748 | Medium | 6.5 | 2024-05-15 | The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to ma… |
CVE-2024-24868 | High | 8.5 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affe… |
CVE-2023-36677 | High | 8.3 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Inje… |
CVE-2023-36530 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions. |
CVE-2023-3063 | High | 8.8 | 2023-06-30 | The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due t… |
CVE-2022-34857 | Medium | 6.1 | 2022-08-22 | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress |
CVE-2022-1551 | Medium | 6.5 | 2022-07-25 | The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other use… |
CVE-2021-4225 | High | 8.8 | 2022-04-25 | The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to pre… |
CVE-2021-38324 | High | 8.2 | 2021-09-09 | The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers… |
CVE-2021-38315 | Medium | 6.1 | 2021-08-16 | The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/func… |
CVE-2021-24347 | High | 8.8 | 2021-06-14 | The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar file… |
CVE-2014-9178 | | | 2014-12-02 | Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1… |
CVE-2013-3529 | | | 2013-05-10 | Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject… |