Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: CatFolders 2.5.7 Clear all filters
TI-2026-85371 CVE-2026-107787 · GHSA-g4cm-95vw-hm27

Missing authorization in CatFolders lets subscribers reset folder ownership

Priority LOW 14

The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and di…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00133 Published 2026-11-05 Fixed in 2.5.7 CWE-862
TI-2026-85370 CVE-2026-107786 · GHSA-wvfh-22pv-4wc4

CatFolders WordPress plugin SQL injection via sortFile setting

Priority LOW 30

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00231 Published 2026-11-05 Fixed in 2.5.7 CWE-89