Vulnerability history

Broken Access Control vulnerability

Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function vulnerability

Authenticated (Admin+) PHP Object Injection via form_data Parameter vulnerability

Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function vulnerability

Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function vulnerability

PHP Object Injection vulnerability

Arbitrary File Upload vulnerability

Cross-Site Request Forgery (CSRF) vulnerability

Order Information Disclosure