Filtered by vendor Mndpsingh287 Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-25105 2 Filemanagerpro, Mndpsingh287 2 File Manager, File Manager 2024-10-30 9.8 Critical
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
CVE-2022-2440 1 Mndpsingh287 1 Theme Editor 2024-08-29 7.2 High
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.