File Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:file_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | File Manager (240bbbc0-2506-54f3-97a5-7c40769bfba2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-17540 |
vulnerable | 2026-09-16 04:33:03.955076 |
Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
Published: 2026-08-10T06:00:10.472Z
Updated: 2026-08-11T20:10:28.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17541 |
vulnerable | 2026-09-16 04:33:03.393285 |
Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Published: 2026-08-10T06:00:10.691Z
Updated: 2026-08-10T19:22:33.386Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17542 |
vulnerable | 2026-09-16 04:33:02.815795 |
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
Published: 2026-08-10T06:00:10.886Z
Updated: 2026-08-10T19:21:21.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-6382 |
vulnerable | 2026-07-29 01:06:20.740879 |
Multiple elFinder Plugins - Authenticated OS Command Injection
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
Published: 2026-07-06T06:00:02.217Z
Updated: 2026-07-06T11:59:43.823Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5907 |
vulnerable | 2026-06-08 06:19:45.059742 |
File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
Published: 2023-12-11T19:22:37.067Z
Updated: 2025-05-27T14:42:08.040Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24177 |
vulnerable | 2026-06-08 05:30:03.919374 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.