CVE-2023-2068

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to...

Design/Logic Flaw

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to...

CVE-2023-2068 File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to...

CVE-2023-2068

The CVE-2023-2068 issue affects the WordPress File Manager Advanced Shortcode plugin (versions

CVE-2023-2068 File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to...

PT-2023-17545

Name of the Vulnerable Software and Affected Versions File Manager Advanced Shortcode WordPress plugin versions 2.3.2 and earlier Description The issue arises from inadequate prevention of uploading files with disallowed MIME types when using the shortcode, leading to remote code execution RCE in...

WordPress File Manager Advanced Shortcode Plugin <= 2.3.2 is vulnerable to Remote Code Execution (RCE)

Software File Manager Advanced Shortcode Type Plugin Vulnerable versions = 2.3.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-2068 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f57871788c33 Credits Mateus Machado Tesser...

CVE-2023-2068: Undefined Security Weakness

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to...

CVE-2023-35885

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

CVE-2023-35885

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

Authentication flaw

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad

Description The plugin does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into...

CloudPanel 安全漏洞

CloudPanel is a free software from CloudPanel open source. It is used to configure and manage servers. A security vulnerability exists in CloudPanel versions prior to 2.3.1 that stems from having insecure file manager cookie authentication...

CVE-2023-35885

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

CVE-2023-35885: Reliance on Cookies without Validation and Integrity Checking

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad

Description The plugin does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into...

CVE-2023-35885

CloudPanel 2.x versions before 2.3.1 are vulnerable due to insecure file-manager cookie authentication, enabling remote code execution as root (CVSS 3.1: 9.8). Public disclosures and proof-of-concept tooling exist (Nuclei template for CVE-2023-35885; GitHub exploit). Affected product: CloudPanel;...

CVE-2023-35885

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication...

WordPress File Manager Pro 8.3.1 Backup Disclosure

==================================================================================================================================== | Title : WordPress - file manager pro 8.3.1 Backup Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

CVE-2023-3295: Unrestricted Upload of File with Dangerous Type

The Unlimited Elements For Elementor Free Widgets, Addons, Templates for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers,...