Filtered by vendor Simplefilelist
Subscriptions
Total
8 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2023-39924 | 1 Simplefilelist | 1 Simple File List | 2024-11-21 | 5.9 Medium |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. | ||||
CVE-2023-1025 | 1 Simplefilelist | 1 Simple File List | 2024-11-21 | 4.8 Medium |
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
CVE-2022-3208 | 1 Simplefilelist | 1 Simple-file-list | 2024-11-21 | 6.5 Medium |
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack. | ||||
CVE-2022-3207 | 1 Simplefilelist | 1 Simple-file-list | 2024-11-21 | 4.8 Medium |
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
CVE-2022-3062 | 1 Simplefilelist | 1 Simple-file-list | 2024-11-21 | 6.1 Medium |
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting | ||||
CVE-2022-1119 | 1 Simplefilelist | 1 Simple-file-list | 2024-11-21 | 7.5 High |
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7. | ||||
CVE-2020-12832 | 1 Simplefilelist | 1 Simple-file-list | 2024-11-21 | 9.8 Critical |
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. | ||||
CVE-2024-10146 | 1 Simplefilelist | 1 Simple File List | 2024-11-15 | 5.4 Medium |
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. |
Page 1 of 1.