SP Project & Document Manager

SP Project & Document Manager has 24 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; 16 are fixed and 8 remain unpatched as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.9 out of 10. Severity breakdown: 5 critical and 7 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (21%). Other recurring categories include SQL Injection, Authorization Bypass Through User-Controlled Key.

16 of the records (67%) have a vendor fix, while 8 remain unpatched. The oldest unresolved one dates back to 2024.

12 independent researchers contributed these findings, most of them (3) reported by CatFather.

01234567891020.11.2014Today20.11.20149.8SP Project & Document Manager < 2.4.4 - Multiple SQL Injection CVSS 9.8 · 20.11.201402.02.20168.8SP Project & Document Manager <= 2.5.9.5 - Cross-Site Request Forgery CVSS 8.8 · 02.02.201607.03.20169.8SP Projects & Document Manager <= 2.6.0.0 - Arbitrary File Upload CVSS 9.8 · 07.03.20169.8SP Projects & Document Manager <= 2.5.9.5 - SQL Injection CVSS 9.8 · 07.03.20166.1SP Projects & Document Manager <= 2.5.9.5 - Cross-Site Scripting CVSS 6.1 · 07.03.201625.05.20218.8SP Project & Document Manager <= 4.21 - Authenticated Shell Upload CVSS 8.8 · 25.05.202128.07.20218.8SP Project & Document Manager <= 4.23 - Subscriber+ Arbitrary File Upload CVSS 8.8 · 28.07.202116.08.20216.1SP Project & Document Manager <= 4.25 - Reflected Cross-Site Scripting CVSS 6.1 · 16.08.202117.06.20229.6SP Project & Document Manager <= 4.56 - Cross-Site Request Forgery and Cross-Site Scripting CVSS 9.6 · 17.06.202228.06.20225.3SP Project & Document Manager <= 4.57 - Sensitive File Disclosure CVSS 5.3 · 28.06.202210.08.20226.1SP Project & Document Manager <= 4.59 - Reflected Cross-Site Scripting CVSS 6.1 · 10.08.20226.1SP Project & Document Manager <= 4.59 - Reflected Cross-Site Scripting CVSS 6.1 · 10.08.202229.06.20238.8SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change CVSS 8.8 · 29.06.202330.06.20234.4SP Project & Document Manager <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVSS 4.4 · 30.06.20238.8SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 30.06.202302.02.20248.8SP Project & Document Manager <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 8.8 · 02.02.202429.03.20246.4SP Project & Document Manager <= 4.70 - Missing Authorization Stored Cross-Site Scripting CVSS 6.4 · 29.03.202416.04.20249.9SP Project & Document Manager <= 4.71 - Authenticated (Author+) SQL Injeciton CVSS 9.9 · 16.04.202424.04.20244.3SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference CVSS 4.3 · 24.04.20244.3SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference to Information Exposure CVSS 4.3 · 24.04.202429.04.20244.3SP Project & Document Manager <= 4.69 - Missing Authorization CVSS 4.3 · 29.04.202407.05.20244.3SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update CVSS 4.3 · 07.05.202421.06.20244.3SP Project & Document Manager <= 4.71 - Authenticated (Subscriber+) Directory Traversal CVSS 4.3 · 21.06.202403.06.20267.5SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function CVSS 7.5 · 03.06.2026

Strategic Overview

Avg CVSSHigh
7.1/ 10
Patch Coverage67%
Open

8

Fixed

16

Get automatic notifications for all SP Project & Document Manager vulnerabilities before they are exploited.

Most severe open issueCVSS 9.9CVE-2024-32551

SP Project & Document Manager <= 4.71 - Authenticated (Author+) SQL Injeciton

Read the full analysis

Vulnerability Records

24 records
2026-06-03 13:01
SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
SP Project & Document Manager
<= 4.71
CVE-2026-10737
7.5
High
NamdnNo
2024-06-21 00:00
SP Project & Document Manager <= 4.71 - Authenticated (Subscriber+) Directory Traversal
SP Project & Document Manager
<= 4.71
CVE-2024-37224
4.3
Medium
CatFatherNo
2024-05-07 00:00
SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
SP Project & Document Manager
<= 4.70
CVE-2024-1693
4.3
Medium
fewwords huangNo
2024-04-29 00:00
SP Project & Document Manager <= 4.69 - Missing Authorization
SP Project & Document Manager
<= 4.69
CVE-2024-33923
4.3
Medium
Abdi PranataNo
2024-04-24 00:00
SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference
SP Project & Document Manager
<= 4.71
CVE-2024-3748
4.3
Medium
fewwords huangNo
2024-04-24 00:00
SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference to Information Exposure
SP Project & Document Manager
<= 4.71
CVE-2024-3749
4.3
Medium
fewwords huangNo
2024-04-16 00:00
SP Project & Document Manager <= 4.71 - Authenticated (Author+) SQL Injeciton
SP Project & Document Manager
<= 4.71
CVE-2024-32551
9.9
Critical
CatFatherNo
2024-03-29 00:00
SP Project & Document Manager <= 4.70 - Missing Authorization Stored Cross-Site Scripting
SP Project & Document Manager
<= 4.70
CVE-2024-31118
6.4
Medium
CatFatherNo
2024-02-02 00:00
SP Project & Document Manager <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode
SP Project & Document Manager
<= 4.69
CVE-2024-24868
8.8
High
belugaYes
2023-06-30 00:00
SP Project & Document Manager <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
SP Project & Document Manager
<= 4.67
CVE-2023-36530
4.4
Medium
emadYes
Showing 1–10 of 24 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C