Wp File Upload

Iptanus File Upload before 5.1.8 does not sanitize and escape an attacker-controlled parameter before placing it in a SQL statement, allowing unauthenticated SQL injection.

An unauthenticated attacker can send crafted input that reaches a database query without safe parameterization in WordPress File Upload 5.1.7 and earlier. Successful exploitation can read or alter WordPress database data within the permissions of the site database account.

WordPress File Upload is affected by filesystem traversal. Exploitation requires an authenticated subscriber account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

WordPress File Upload is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

WordPress File Upload is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wp File Upload is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wp File Upload is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Wp File Upload is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wp File Upload is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wp File Upload is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wp File Upload is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wp File Upload is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wp File Upload is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wp File Upload is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.