CVE-2018-16363

CVE-2018-16363 affects the WordPress plugin mndpsingh287 File Manager (v2.9) and is triggered via the lang parameter in the admin interface (wp-admin/admin.php?page=wp_file_manager). The root cause is the use of set_transient in file_folder_manager.php and an echo of the lang value in lib/wpfilem...

PT-2018-13518 · Mndpsingh287 · Wp File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 File Manager plugin version 2.9 Description: The issue concerns a cross-site scripting XSS problem. It occurs via the lang parameter in a "wp-admin/admin.php?page=wp file manager" request. This happens because set transient is us...

CVE-2018-16363: Improper Neutralization of Input During Web Page Generation

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wpfilemanager request because settransient is used in filefoldermanager.php and there is an echo of lang in lib\wpfilemanager.php...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators https://example.com/wp-admin/admin.php?page=wpfilemanager&lang=zhCNalertXSS...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators PoC https://example.com/wp-admin/admin.php?page=wpfilemanager〈=zhCNalertXSS...

CVE-2018-16373

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/filemanager/save...

CVE-2018-16373

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/filemanager/save...

Design/Logic Flaw

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/filemanager/save...

CVE-2018-16373

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/filemanager/save...

Frog CMS File Upload Vulnerability (CNVD-2019-10141)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A file upload vulnerability exists in Frog CMS 0.9.5, which can be exploited by an attacker via /admin/?...

Responsive FileManager Information Disclosure Vulnerability

Responsive FileManager is an open source file manager written in PHP that supports uploading and managing videos, images and other files. An information disclosure vulnerability exists in the /filemanager/upload.php file in versions of Responsive FileManager prior to 9.13.3, which stems from the...

CVE-2018-15495

/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curlexec call, as demonstrated by a file:///etc/passwd value...

CVE-2018-14728

CVE-2018-14728 affects Responsive FileManager 9.13.1 where the upload.php endpoint allows a server‑side request forgery (SSRF) via the parameter. The issue is documented in multiple sources (NVD entry for CVE‑2018‑14728 and the Nuclei template) and is classified as high/critical impact (NS: netw...

Huawei SafeBox Manager Security Bypass Vulnerability

Huawei SafeBox Manager is a security product from huawei. The Huawei SafeBox Manager security bypass vulnerability allows attackers to exploit a vulnerability to bypass the Secure File Manager privileges to access sensitive device information or files...

Huawei SafeBox Manager 6.30.057.L - Bypass Vulnerability

Document Title: =============== Huawei SafeBox Manager 6.30.057.L - Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1789 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2018-13790

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

CVE-2018-13790

CVE-2018-13790 affects concrete5 8.2.0 via SSRF in tools/files/importers/remote.php, allowing an attacker to cause requests to internal hosts (local-network discovery/mapping) through the File Manager URL handling. NVD CVSS metrics show CVSS‑3.1 base score 7.2 (HIGH) with network attack vector, l...

CMS Made Simple File Manager Remote Code Execution (CVE-2018-1000094)

A remote command execution vulnerability exists in the File Manager interface of CMS Made Simple 2.2.5. By uploading a malicious file, an authenticated attacker with administrator privileges can exploit this vulnerability for execution of arbitrary code...

CVE-2018-13790: Server-Side Request Forgery (SSRF)

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...