Sp Project & Document Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:sp_project_&_document_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Sp Project & Document Manager (80ef9035-64f9-52db-b3e3-5c3773cd41dd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-3749 |
vulnerable | 2026-06-08 06:43:51.374506 |
SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
Published: 2024-05-15T06:00:04.713Z
Updated: 2024-08-01T20:20:01.139Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3748 |
vulnerable | 2026-06-08 06:43:51.372233 |
SP Project & Document Manager <= 4.71 - Data Update via IDOR
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user
Published: 2024-05-15T06:00:04.491Z
Updated: 2024-08-01T20:20:01.097Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1551 |
vulnerable | 2026-06-08 05:39:13.405744 |
SP Project & Document Manager < 4.58 - Sensitive File Disclosure
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
Published: 2022-07-25T12:46:15.000Z
Updated: 2024-08-03T00:10:03.030Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4225 |
vulnerable | 2026-06-08 05:38:08.966304 |
SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
Published: 2022-04-25T15:50:53.000Z
Updated: 2024-08-03T17:16:04.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24347 |
vulnerable | 2026-06-08 05:30:04.226995 |
SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Published: 2021-06-14T13:37:12.000Z
Updated: 2024-08-03T19:28:23.833Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.