Fileorganizer
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:fileorganizer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Fileorganizer (b53d7e2a-1ed3-5dc9-af75-371e70de56b2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6382 |
vulnerable | 2026-07-29 01:06:20.736919 |
Multiple elFinder Plugins - Authenticated OS Command Injection
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
Published: 2026-07-06T06:00:02.217Z
Updated: 2026-07-06T11:59:43.823Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11962 |
vulnerable | 2026-07-29 00:23:31.835655 |
FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
Published: 2026-07-06T06:00:01.869Z
Updated: 2026-07-06T12:14:33.831Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3664 |
vulnerable | 2026-06-08 06:09:40.140582 |
FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
Published: 2023-09-25T15:56:55.853Z
Updated: 2024-09-23T19:40:58.978Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.