Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
oryginał ENCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HW3eden Download Manager
APPW3Eden≤ 3.1.24
Powiązane podatności
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u...
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper auth...
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upo...
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a passwor...
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and incl...