CVE-2025-10744

Sažetak

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view information like full paths and full paths to backup files information contained in the exposed log files.

Reference

https://plugins.trac.wordpress.org/browser/softdiscover-db-file-manager/tags/1.5.0/modules/filemanager/controllers/backup.php#L460
https://plugins.trac.wordpress.org/browser/softdiscover-db-file-manager/tags/1.5.0/modules/filemanager/helpers/iprogress.php#L19
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369101%40softdiscover-db-file-manager&new=3369101%40softdiscover-db-file-manager&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/30147e39-af94-4620-870b-71a0a46b7509?source=cve

CVSS

Base:	5.3
Impact:	1.4
Exploitability:	3.9

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
LOW	NONE	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Zadnje važnije ažuriranje

02-10-2025 - 19:12

Objavljeno

01-10-2025 - 04:16