Vulnerability history

Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function vulnerability

Authenticated (Admin+) PHP Object Injection via form_data Parameter vulnerability

Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function vulnerability

Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function vulnerability

Deserialization of untrusted data vulnerability

Path Traversal vulnerability

Authenticated (Shop Manager+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change vulnerability

Arbitrary User Creation vulnerability

CSV Injection vulnerability