Read the docs

Mediajedi

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Mediajedi records in CISA KEV

No Mediajedi vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
User Private Files 2 records HIGH

Records

2 records

TI-2022-02175 CVE-2022-2356 · GHSA-r7g6-6vgc-xh4c

User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

Priority HIGH 77

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00992 Published 2022-08-08 Fixed in 1.1.3 CWE-434
TI-2024-07273 CVE-2024-7848 · GHSA-pcr4-qppj-9v45

User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access

Priority LOW 29

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing valid…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0031 Published 2024-08-22 No fix listed CWE-639
Open these records in search →