3218 matches found
WordPress File Management Plugin Riddled with Critical Bugs
A critical cross-site scripting XSS bug impacts WordPress sites running the Frontend File Manager plugin and allows remote unauthenticated users to inject JavaScript code into vulnerable websites to create admin user accounts. The bug is one of six critical flaws impacting the WordPress plugin...
WordPress Frontend File Manager plugin <= 18.2 - Authenticated Settings Change and Arbitrary File Upload vulnerabilities
Authenticated Settings Change and Arbitrary File Upload vulnerabilities discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...
WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated HTML Injection vulnerability
Unauthenticated HTML Injection vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...
WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion vulnerability
Unauthenticated Arbitrary Post Deletion vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...
Frontend File Manager < 18.3 - Privilege Escalation
The wpfmgetcurrentuser function of the plugin did not properly check for the user ID, allowing it to be overridden by providing the fileowner GET parameter...
WordPress Frontend File Manager plugin <= 17.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 17.1. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.0...
Frontend File Manager < 18.3 - Unauthenticated HTML Injection
The wpfmsendfileinemail AJAX action of the plugin, available to unauthenticated users, was lacking CSRF, capability check, sanitisation and validation, allowing unauthenticated users to send arbitrary emails to any email address...
WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated Post Meta Change and Arbitrary File Download vulnerability
Unauthenticated Post Meta Change and Arbitrary File Download vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...
Frontend File Manager < 18.3 - Unauthenticated Content Injection and Stored XSS
The wpfmeditfiletitledesc AJAX action of the plugin, available to unauthenticated users, did not check if users were editing their own post and was lacking a CSRF nonce as well. This could allow an unauthenticated user to update any post/page. Furthermore, by editing a post with the 'wpfm-files'...
Frontend File Manager < 18.3 - Authenticated Arbitrary Settings Change to Arbitrary File Upload
The wpfmsavesettings AJAX action of the plugin, available to any authenticated user, was lacking CSRF and capability check, allowing any authenticated user to change the settings, and add PHP to the allowed filetype to be uploaded, which would then allow them to upload a malicious PHP file via th...
Frontend File Manager < 18.3 - Unauthenticated Arbitrary Post Deletion
The wpfmdeletefile AJAX action of the plugin, available to unauthenticated users, was lacking CSRF and capability check, allowing unauthenticated users to delete arbitrary posts and pages from the blog...
WordPress Frontend File Manager plugin <= 18.2 - Unauthenticated Content Injection and Stored XSS vulnerabilities
Unauthenticated Content Injection and Stored XSS vulnerabilities discovered by Jerome Bruandet NinTechNet in WordPress Frontend File Manager plugin versions = 18.2. Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 18.3...
The vulnerability of the fly-fm file manager, related to insufficient data processing within the security mechanisms, allows a perpetrator to trigger a service failure.
The vulnerability of the fly-fm file manager is related to the first connection of a network location via sftp. Exploiting this vulnerability allows an attacker who operates remotely to gain access to confidential data due to a denial-of-service attack...
The vulnerability of the fly-fm file manager, related to insufficient validation of input data, allows a hacker to trigger a service failure.
The vulnerability of the fly-fm file manager is related to incorrect calculation of MD5 in the program window. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
The vulnerability of the fly-fm file manager, related to errors in its code, allows a perpetrator to gain access to confidential data.
The vulnerability of the fly-fm file manager is related to an incorrect password request from the user for accessing the password storage. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...
elFinder 安全漏洞
elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling and other features. A security vulnerability exists in ElFinder 2.1.47 and earlier versions, which stems from a command injection vulnerability in the program's P...
Pandora FMS Information Disclosure Vulnerability
Pandora FMS is a monitoring system from Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. An information disclosure vulnerability exists in the File Manager component of Pandora FMS 754 and earlier versions. An attacker cou...
CVE-2021-34075
In Artica Pandora FMS =754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access...
