WordPress Advanced File Manager plugin <= 5.3.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by tiborisaak in WordPress Plugin Advanced File Manager versions = 5.3.6...

WordPress File Manager Plugin <= 8.4.2 is vulnerable to Arbitrary File Deletion

Software File Manager Type Plugin Vulnerable versions = 8.4.2 Fixed in 8.4.3 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2025-0818 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 5d1e46fce6a0 Credits tiborisaak Required privilege...

Microsoft Windows File Explorer 信息泄露漏洞

Microsoft Windows File Explorer is a file manager application from Microsoft USA. A spoofing vulnerability exists in Microsoft Windows File Explorer that is caused by the exposure of sensitive information to unauthorized participants in File Explorer. An attacker could exploit the vulnerability t...

CVE-2013-10054

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

CVE-2025-6986: Improper Neutralization of Special Elements used in an SQL Command

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2013-10054

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

CVE-2013-10054

CVE-2013-10054 affects LibrettoCMS (1.1.7 and possibly earlier) via the File Manager plugin. The upload handler at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php does not properly validate file extensions, allowing unauthenticated upload of files that can be renamed to executable .php s...

CVE-2013-10054 LibrettoCMS File Manager Arbitrary File Upload

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

📄 Malicious XDG Desktop File

This Metasploit module creates a malicious XDG Desktop .desktop file. On most modern systems, desktop files are not trusted by default. The user will receive a warning prompt that the file is not trusted when running the file, but may choose to run the file anyway. The default file manager...

CVE-2013-10054: Unrestricted Upload of File with Dangerous Type

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 and possibly earlier contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails ...

Sourceforge LibrettoCMS 安全漏洞

Sourceforge LibrettoCMS is an open source content management system from Sourceforge. A security vulnerability exists in Sourceforge LibrettoCMS 1.1.7 and earlier versions, which stems from a file manager plugin that does not properly validate file extensions, and could lead to remote code...

CVE-2023-7306

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...

CVE-2023-7306

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...

CVE-2023-7306

The CVE-2023-7306 entry concerns the Frontend File Manager Plugin for WordPress (versions up to 21.5). The vulnerability is caused by a missing capability check in wpfm_delete_multiple_files(), enabling unauthenticated attackers to delete arbitrary posts and cause data loss. The issue is confirme...

CVE-2023-7306 Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...

CVE-2023-7306 Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...

CVE-2014-125115: Use of Hard-coded Credentials

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhashdata parameter, allowing attackers to extract administrator credentials or active session tokens via crafted...

PT-2025-30738 · WordPress · Frontend File Manager Plugin

Name of the Vulnerable Software and Affected Versions: Frontend File Manager Plugin for WordPress versions prior to 21.5 Description: The plugin is susceptible to unauthorized data loss due to a missing capability check within the wpfm delete multiple files function. This allows unauthenticated...

WordPress plugin Frontend File Manager Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-7306: Missing Authorization

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...