CVE-2021-24177: falha em File Manager
WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.9%
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
Produtos afetados
Unknown · File ManagerCVEs relacionadas — File Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2026-6382CRITICALMultiple elFinder Plugins - Authenticated OS Command InjectionEPSS 1.4%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%CVE-2026-17541HIGHBit File Manager < 6.9.1 - Unauthenticated File Activity Log DisclosureEPSS 0.4%CVE-2026-17542HIGHBit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connectorEPSS 0.4%CVE-2026-85081HIGHMultiple elFinder Plugins - DOM-based XSS via postMessage Origin BypassEPSS 0.2%