wp-file-manager 漏洞

严重CVE-2023-68252026/05/05

WordPress File Manager <= 7.2.1 - Directory Traversal

File Manager and File Manager Pro plugins for WordPress versions up to 7.2.1 and 8.3.4 contain a directory traversal caused by the 'target' parameter in mk_file_folder_manager_action_callback_shortcode, letting attackers read arbitrary files and upload files outside designated directories, exploit requires administrator privileges for free version and can be exploited by lower-level users in Pro version.

wp-file-managerPoC 已收录

CVSS—

中危CVE-2018-163632026/02/26

WordPress File Manager < 3.0 - Cross-Site Scripting

WordPress File Manager plugin before 3.0 is vulnerable to authenticated reflected cross-site scripting (XSS) via the lang parameter in the admin dashboard. The parameter is directly echoed into a JavaScript context without proper sanitization.

wp-file-managerPoC 已收录

CVSS—

wp-file-manager

关联漏洞

WordPress File Manager <= 7.2.1 - Directory Traversal

WordPress File Manager < 3.0 - Cross-Site Scripting