Simplefilelist
Simplefilelist Simple File List: vulnerabilidades y CVE
Simplefilelist Simple File List tiene 15 vulnerabilidades publicadas, 8 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE15
Últimos 12 meses8
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-16617 | Alta (8.8) | 0.51% | — | 19 ago 2026 | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file… |
| CVE-2026-16616 | Alta (8.6) | 0.73% | — | 19 ago 2026 | The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate… |
| CVE-2026-57382 | Alta (7.1) | 0.25% | — | 13 jul 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a… |
| CVE-2026-12119 | Media (6.5) | 0.47% | — | 20 jun 2026 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This… |
| CVE-2026-11912 | Alta (7.5) | 0.52% | — | 20 jun 2026 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated… |
| CVE-2026-11911 | Alta (7.5) | 1.2% | — | 20 jun 2026 | The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it… |
| CVE-2026-24953 | Media (6.5) | 0.39% | — | 20 feb 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a… |
| CVE-2025-68591 | Media (5.4) | 0.25% | — | 24 dic 2025 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <=… |
| CVE-2025-54021 | Alta (7.5) | 0.41% | — | 20 ago 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a… |
| CVE-2020-36847 | Crítica (9.8) | 45% | — | 12 jul 2025 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use… |
| CVE-2025-47450 | Media (5.3) | 0.33% | — | 7 may 2025 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <=… |
| CVE-2024-10146 | Media (5.4) | 0.58% | — | 14 nov 2024 | The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. |
| CVE-2023-44227 | Alta (7.5) | 0.56% | — | 17 abr 2024 | Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9. |
| CVE-2023-39924 | Media (4.8) | 0.39% | — | 25 oct 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. |
| CVE-2023-1025 | Media (4.8) | 0.44% | — | 27 mar 2023 | The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.