Not rated
CVE-2021-24347 The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin…
Description
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SP Project & Document Manager 4.22 | earliest → < 4.22 | 4.22 |
Other CVEs of SP Project & Document Manager
The 5 CVEs of SP Project & Document Manager →
CVE-2024-3748
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a…
6.5
Medium
CVE-2024-3749
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in…
6.5
Medium
CVE-2022-1551
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad…
Not rated
CVE-2021-4225
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to…
Not rated