CVE-2024-8743

MEDIUM Year: 2024
CVSS v3 Score
6.8
Medium
Weakness Type
CWE-434
View all →

Vulnerability Description

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.

Related Vulnerabilities

CVE-2016-10258

MEDIUM
CVSS:6.8(Medium)

Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the ma...

CWE-4342016

CVE-2018-18565

MEDIUM
CVSS:6.8(Medium)

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, Coag...

CWE-4342018

CVE-2022-22392

MEDIUM
CVSS:6.8(Medium)

IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066.

CWE-4342022

CVE-2023-28700

MEDIUM
CVSS:6.8(Medium)

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to...

CWE-4342023

CVE-2023-30968

MEDIUM
CVSS:6.8(Medium)

One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent cross site scripting ...

CWE-4342023

CVE-2023-32562

MEDIUM
CVSS:6.8(Medium)

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.

CWE-4342023