CVE-2022-2356

CVE-2022-2356: User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

Vendor Unknown

Product Frontend File Manager & Sharing – User Private Files

Weakness CWE-434 · Unrestricted file upload

Published August 8, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

Key dates

02Disclosure timeline

August 8, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2356 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2026-56414 H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type CVE-2023-4097 Multiple vulnerabilities in IDM Sistemas QSige CVE-2023-1501 RockOA acloudCosAction.php.SQL runAction unrestricted upload CVE-2023-47873 WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability CVE-2024-51919 WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability