Smarty Pants Plugins SP Project & Document Manager

SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload

SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection

WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.

WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability

SP Project & Document Manager < 4.58 - Sensitive File Disclosure

SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR

SP Project & Document Manager <= 4.71 - Data Update via IDOR

SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting

WordPress SP Project & Document Manager plugin <= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerability

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS)