Description
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.
Remediation
References
Related Vulnerabilities
WordPress Plugin Loginizer SQL Injection (1.6.3)
WordPress Plugin Rimons Twitter Widget Cross-Site Scripting (1.2.4)
phpMyFAQ Uncaught Exception Vulnerability (CVE-2023-0790)
WordPress Plugin Uploader 'uploadify.php' Arbitrary File Upload (1.0.4)
Jboss EAP Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-3859)