CVE-2023-5105

The CVE-2023-5105 affects the WordPress Frontend File Manager Plugin (wpfm-files) prior to version 22.6. An Editor+ user can bypass the download logic to arbitrarily download sensitive files (e.g., wp-config.php) by manipulating wpfm_dir_path/wpfm_file_url, as shown in published PoC steps. The vu...

CVE-2023-5105 Frontend File Manager < 22.6 - Editor+ Arbitrary File Download

The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php...

WordPress plugin Frontend File Manager Plugin security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-30728 · Unknown · Sunlight Cms

Name of the Vulnerable Software and Affected Versions: Sunlight CMS version 8.0.1 Description: A Cross-Site Scripting XSS issue allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component. Recommendations: For Sunlight CMS version 8.0.1,...

The vulnerability of the Adobe Bridge file manager relates to the use of memory after it is freed, allowing an attacker to bypass the ASLR protection mechanism.

The vulnerability of the Adobe Bridge file manager is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to bypass the ASLR protection mechanism...

The vulnerability of the Adobe Bridge file manager relates to the use of an uninitialized pointer, which allows an attacker to bypass the ASLR protection mechanism.

The vulnerability of the Adobe Bridge file manager is related to the use of an uninitialized pointer. Exploiting this vulnerability could allow an attacker to bypass the ASLR protection mechanism...

The vulnerability of the Adobe Bridge file manager relates to the use of an uninitialized pointer, which allows an attacker to bypass the ASLR protection mechanism.

The vulnerability of the Adobe Bridge file manager is related to the use of an uninitialized pointer. Exploiting this vulnerability could allow an attacker to bypass the ASLR protection mechanism...

CVE-2023-6302

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been...

CVE-2023-6302

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been...

Design/Logic Flaw

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been...

CVE-2023-6302 CSZCMS File Manager Page templates permission

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been...

CVE-2023-6302

CSZCMS 1.3.0 has a vulnerability in the File Manager Page templates (viewstemplates) that allows permission issues. The root cause is tied to unknown functionality in the affected templates, enabling remote exploitation with publicly disclosed exploit details. Multiple sources (NVD, CVE records a...

CVE-2023-6302 CSZCMS File Manager Page templates permission

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been...

PT-2023-14046 · Oro · Oroplatform

Name of the Vulnerable Software and Affected Versions: OroPlatform versions prior to 5.0.9 Description: Path Traversal is possible in OroBundleGaufretteBundleFileManager::getTemporaryFileName. With this method, an attacker can pass the path to a non-existent file, which will allow writing the...

PT-2023-32602 · Csz Cms · Csz Cms

Name of the Vulnerable Software and Affected Versions: CSZCMS version 1.3.0 Description: A critical issue was found in the File Manager Page component, specifically in the viewstemplates file, leading to permission issues. The attack can be launched remotely. The issue has been publicly disclosed...

CSZCMS License Issue Vulnerability

CSZCMS is an open source web application that allows managing all content and settings on a website. An authorization issue vulnerability exists in CSZCMS version 1.3.0, which stems from an unknown function in the file view template in the component File Manager Page, resulting in a permissions...

Artica Pandora FMS Security Vulnerability

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS versions 700 through 773, which stems from an improperly restricted...

PT-2023-28109 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue allows unrestricted upload of files with dangerous types, specifically PHP executable files, through the file manager. This is due to accessing functionality not properly constrained...

The Continued Evolution of the DarkGate Malware-as-a-Service

The Continued Evolution of the DarkGate Malware-as-a-Service By Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll and Vinoo Thomas · November 21, 2023 On September 2023, the Trellix Security Operations Center SOC successfully detected and stopped an attack against Musarubra, the holding...

File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal

Description The plugin does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites...