Skip to content
OpenAdvisories

Vendor

smartypants

12 known vulnerabilities.

Products

SP Project & Document Manager 11 SP Project & Document Manager (WordPress plugin) 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-10737

    SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function

    The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read fi…

    smartypants SP Project & Document Manager Web / CMS
  • High 7.5
    CVE-2024-37224

    WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71.

    smartypants SP Project & Document Manager
  • High 7.6
    CVE-2024-32551

    WordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.71.

    smartypants SP Project & Document Manager
  • High 8.5
    CVE-2024-24868

    WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.

    smartypants SP Project & Document Manager
  • High 8.3
    CVE-2023-36677

    WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.

    smartypants SP Project & Document Manager
  • High 8.8
    CVE-2023-3063

    SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

    The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and ac…

    smartypants SP Project & Document Manager Web / CMS