Non notée
CVE-2021-4225 The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to…
Description
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SP Project & Document Manager 4.24 | premières → < 4.24 | 4.24 |
Autres CVE de SP Project & Document Manager
Les 5 CVE de SP Project & Document Manager →
CVE-2024-3748
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a…
6.5
Moyenne
CVE-2024-3749
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in…
6.5
Moyenne
CVE-2022-1551
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad…
Non notée
CVE-2021-24347
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin…
Non notée