CVE-2008-3362
Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an ...
Affects 2 products across 2 vendors.
Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.
Show all 51
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows attackers to upload and execute arbitrary code on the server.
BSID: BS-2008-GLOBAL-169038-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2008-3362?
What is the CVSS score for CVE-2008-3362?
Is CVE-2008-3362 actively exploited?
How do I remediate CVE-2008-3362?
What systems are affected by CVE-2008-3362?
| CVE ID | CVE-2008-3362 |
|---|---|
| BSID | BS-2008-GLOBAL-169038-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2008-07-30 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.
Source: NIST NVD / MITRE CVE Database
The vulnerability is due to an unrestricted file upload feature in upload.php, where attackers can upload files with executable extensions via the upfile parameter. Once uploaded, these files can be executed by directly accessing them through the web server.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Giulio Ganci | Wp Downloads Manager | 0.2 |
| Wordpress | Wp Downloads Manager | 0.2 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →