CVE-2025-12640: Missing Authorization

The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the...

CVE-2025-14804

The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server...

CVE-2019-16790

In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted...

CVE-2024-2654

The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fmdownloadbackup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the...

CVE-2024-2604

A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update-file.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit...

CVE-2025-14804 Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion

The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server...

CVE-2025-14804 Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion

The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server...

CVE-2025-14804

The Frontend File Manager Plugin for WordPress (versions before 23.5 ) is vulnerable to an arbitrary file deletion flaw. The root cause is a failure to validate a path parameter and verify file ownership . This security weakness allows any authenticated user, including those with limited permissi...

PT-2026-1562

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.5 Description The Frontend File Manager Plugin for WordPress did not properly check a file path and who owned the file. This allowed any logged-in user, even those with limited permissions like...

WordPress plugin Frontend File Manager Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security...

CVE-2025-14804: Undefined Security Weakness

The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server...

Code-Projects Student File Management System 授权问题漏洞

Code-Projects Student File Management System is an open source student file management system from Code-Projects. An authorization issue vulnerability exists in Code-Projects Student File Management System version 1.0, which stems from incorrect manipulation of the storeid parameter in...

CVE-2025-15143

A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.php of the component Backend Template Management. The manipulation of the argument content results in sql injection. It is possible to laun...

Exploit for Path Traversal in Tinyfilemanager_Project Tinyfilemanager

TinyFileManager v2.6 - File Upload Extension Bypass to Remote...

CVE-2025-65790

A reflected cross-site scripting XSS vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline...

PT-2025-52846

Name of the Vulnerable Software and Affected Versions Cadmium CMS version 0.4.9 Description Cadmium CMS version 0.4.9 has a background arbitrary file upload issue in the /admin/content/filemanager/uploads endpoint. The vulnerability allows for unauthorized file uploads. The uploads directory is t...

CVE-2025-65790

A reflected cross-site scripting XSS vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline element, the browser executes...

CVE-2025-65790

A reflected cross-site scripting XSS vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline element, the browser executes...

CVE-2025-65790

A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 due to the lack of sanitization when serving SVG files through the /fs/ file manager interface. Because the software does not restrict script execution within SVG content, an attacker can craft an SVG file containing an in...

PT-2025-52679

Name of the Vulnerable Software and Affected Versions FuguHub version 8.1 Description A reflected cross-site scripting XSS issue exists when serving SVG files through the /fs/ file manager interface. The software does not sanitize or restrict script execution within SVG content. An attacker can...