CVE-2020-24312

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

CVE-2020-24312

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

Design/Logic Flaw

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

CVE-2020-24312

Summary: WordPress File Manager (wp-file-manager) plugin versions ≤ 6.4 are vulnerable to a backup disclosure due to failing to restrict access to the fm_backups directory via .htaccess, allowing unauthenticated users to browse/download site backups (potentially full database backups). Root cause...

CVE-2020-24312

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

WordPress File Manager plugin <= 6.4 - Backup File Directory Listing vulnerability

Backup File Directory Listing vulnerability found by zerodetail & ratherbland in WordPress File Manager plugin versions = 6.4. Solution Update the WordPress File Manager plugin to the latest available version at least 6.5...

PT-2020-15677

Name of the Vulnerable Software and Affected Versions WP File Manager versions 6.4 and lower Description The issue allows unauthenticated users to browse and download site backups, including full database backups, due to the lack of restriction on external access to the fm backups directory. This...

CVE-2020-24312: Files or Directories Accessible to External Parties

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

Exploit for Unrestricted Upload of File with Dangerous Type in Webdesi9 File_Manager

CVE-2020-25213 wp-file-manager 6.7 20th Aug 2020 Wordpress...

Cross site scripting

PRODUCT NOT SUPPORTED WHEN ASSIGNED A Cross Site Scripting XSS vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no...

PT-2020-13860 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad versions 1.7.8 and later Description: A Cross Site Scripting XSS issue was found due to improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. The vendor states that Codiad is no long...

CMS Made Simple Code Issue Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

CMS Made Simple <= 2.2.15 Arbitrary File Upload Vulnerability

CMS Made Simple is prone to an arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-17462

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...

CVE-2020-17462

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...

Design/Logic Flaw

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...

CVE-2020-17462

CMS Made Simple 2.2.14 is affected by an authenticated arbitrary file upload vulnerability in the File Manager due to not blocking .ptar files, a related issue to CVE-2017-16798. Multiple sources (NVD/CVE records, OpenVAS listing) note the issue affects 2.2.14 and, per OpenVAS, also 2.2.15 and ea...

CVE-2020-17462

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...

PT-2020-15005

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.14 Description The issue allows authenticated arbitrary file upload due to the File Manager not blocking .ptar files. Recommendations For CMS Made Simple version 2.2.14, update to a newer version that contains a fix...

CVE-2020-17462: Unrestricted Upload of File with Dangerous Type

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...