Wp-Dbmanager Project: >> Wp-Dbmanager >> 2.05 Security Vulnerabilities
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
CVSS Score
7.2
EPSS Score
0.002
Published
2022-08-15
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score
7.8
EPSS Score
0.001
Published
2018-01-05
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
CVSS Score
6.5
EPSS Score
0.013
Published
2018-01-05
The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
CVSS Score
6.5
EPSS Score
0.043
Published
2014-10-31