CVE-2024-8126: falha de alta gravidade em saadiqbal Advanced File Manager – Ultimate…
Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.9%
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
saadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library SolutionCVEs relacionadas — saadiqbal Advanced File Manager – Ultimate…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-0818MEDIUMMultiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File DeletionEPSS 1.0%CVE-2024-8704HIGHAdvanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_localeEPSS 0.9%CVE-2024-11391HIGHAdvanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.7%CVE-2024-5598HIGHAdvanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory ListingEPSS 0.6%CVE-2026-15009MEDIUMAdvanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' ParameterEPSS 0.4%CVE-2024-8725MEDIUMAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File UploadEPSS 0.4%