7.2
Élevée
CVE-2024-8704 The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to,…
Description
The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Advanced File Manager 5.2 | premières → 5.2.8 | Pas de correctif indiqué |
| advanced_file_manager 5.2 | premières → < 5.2.9 | 5.2.9 |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution 5.2 | premières → 5.2.8 | Pas de correctif indiqué |
Autres CVE de Advanced File Manager
Les 5 CVE de Advanced File Manager →
CVE-2024-11391
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…
7.5
Élevée
CVE-2024-8725
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions
6.8
Moyenne
CVE-2024-8126
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php'…
7.5
Élevée
CVE-2024-5598
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…
7.5
Élevée