File Manager Pro
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:file_manager_pro:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | File Manager Pro (ca3fba71-5ce5-5352-befc-d630537ce2b4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6382 |
vulnerable | 2026-07-29 01:06:20.739785 |
Multiple elFinder Plugins - Authenticated OS Command Injection
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
Published: 2026-07-06T06:00:02.217Z
Updated: 2026-07-06T11:59:43.823Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4862 |
vulnerable | 2026-06-08 06:16:14.751072 |
File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
Published: 2023-10-16T19:38:56.312Z
Updated: 2024-08-02T07:38:00.803Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4861 |
vulnerable | 2026-06-08 06:16:14.749660 |
File Manager Pro < 1.8.1 - Admin+ Remote Code Execution
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
Published: 2023-10-16T19:39:21.036Z
Updated: 2025-04-23T16:11:26.687Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4827 |
vulnerable | 2026-06-08 06:16:14.675662 |
File Manager Pro < 1.8 - Remote Code Execution via CSRF
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
Published: 2023-10-16T08:32:43.945Z
Updated: 2025-04-23T16:15:08.767Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.