CVE-2022-3076

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	CM Download Manager	>= 2.8.6, < 2.8.6

References

https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bdExploit, Patch, Third Party Advisory
https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bdExploit, Patch, Third Party Advisory

Timeline

Published: Sep 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-307604.3An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obt CVE-2022-307637.5Janet before 1.22.0 mishandles arrays.CVE-2022-307659.8Calibre-Web before 0.6.18 allows user table SQL Injection.CVE-2022-307679.8nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, le CVE-2022-307685.4A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field CVE-2022-307694.6Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.CVE-2022-30775.5A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_CVE-2022-307706.1Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerab CVE-2022-307718.2Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm c CVE-2022-307728.2Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of CVE-2022-307736.4DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but befor CVE-2022-307746.4DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before