CVE-2022-3126

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-312606.5In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a nonCVE-2022-312617.5An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be CVE-2022-312627.8An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker canCVE-2022-312635.3app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.CVE-2022-312647.5Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF pCVE-2022-312658.8The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replayCVE-2022-312664.3In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounCVE-2022-312679.8Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as anCVE-2022-312687.5A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-ICVE-2022-312698.2Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's dooCVE-2022-31275.4Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.CVE-2022-312739.8An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted ses
CVE-2022-3126: Medium severity, CVSS 4.3 | Vulnix