242 matches found
CVE-2022-1551: Direct Request
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...
PT-2022-13952 · WordPress · Sp Project & Document Manager
Name of the Vulnerable Software and Affected Versions: The SP Project & Document Manager WordPress plugin versions prior to 4.58 Description: The issue allows bad actors to access other users' sensitive files due to an easily guessable path used to store user files. Recommendations: For versions...
WordPress plugin SP Project & Document Manager has a vulnerability related to information leakage.
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. An information disclosure vulnerability exists in...
CVE-2021-4225
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovere...
Design/Logic Flaw
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovere...
CVE-2021-4225
The CVE concerns the SP Project & Document Manager WordPress plugin (pre-4.24). The issue arises in the file-upload feature, where authentication is not restricted and users such as subscribers can upload files. The vendor’s extension-based checks are intended to block executable PHP or similar f...
WordPress plugin SP Project & Document Manager code-related vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress SP Project...
PT-2022-11579
Name of the Vulnerable Software and Affected Versions SP Project & Document Manager WordPress plugin versions prior to 4.24 Description The issue allows any authenticated users to upload files, despite the plugin's attempt to prevent PHP and other executable files from being uploaded by checking...
CVE-2021-4225: Unrestricted Upload of File with Dangerous Type
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovere...
CVE-2021-38315
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
CVE-2021-38315
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
Cross site scripting
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
CVE-2021-38315 SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
CVE-2021-38315
The CVE-2021-38315 entry concerns the SP Project & Document Manager WordPress plugin (versions
SP Project & Document Manager < 4.26 - Reflected Cross-Site Scripting
The plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts https://example.com/wp-admin/admin.php?page=sp-client-document-manager&from=" style=animation-name:rotation...
PT-2021-22032
Name of the Vulnerable Software and Affected Versions: The SP Project & Document Manager WordPress plugin versions up to and including 4.25 Description: The issue allows attackers to inject arbitrary web scripts via attribute-based Reflected Cross-Site Scripting. This is possible through the from...
CVE-2021-38315: Improper Neutralization of Input During Web Page Generation
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
WordPress SP Project & Document Manager plugin <= 4.25 - Attribute-based Reflected Cross-Site Scripting (XSS) vulnerability
Attribute-based Reflected Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress SP Project & Document Manager plugin versions = 4.25. Solution Update the WordPress SP Project & Document Manager plugin to the latest available version at least 4.26...