Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Mediajedi Component: User Private Files Clear all filters
TI-2024-07273 CVE-2024-7848 · GHSA-pcr4-qppj-9v45

User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access

Priority LOW 29

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing valid…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0031 Published 2024-08-22 No fix listed CWE-639
TI-2022-02175 CVE-2022-2356 · GHSA-r7g6-6vgc-xh4c

User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

Priority HIGH 77

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00992 Published 2022-08-08 Fixed in 1.1.3 CWE-434