CVE-2021-35506

Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action...

Design/Logic Flaw

Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action...

Remote code execution

Afian FileRun 2021.03.26 allows Remote Code Execution by administrators via the Check Path value for the ffmpeg binary...

Cross site scripting

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...

CVE-2021-35505

CVE-2021-35505 affects Afian FileRun 2021.03.26. The vulnerability enables Remote Code Execution by administrators via the Check Path value for the magick binary. The description identifies a path/command handling issue in the magick binary check, leading to code execution with the attacker’s cho...

CVE-2021-35504

CVE-2021-35504 affects Afian FileRun 2021.03.26 and enables Remote Code Execution (RCE) via the Check Path value used for the ffmpeg binary. The Red Hat and CVE/NVD entries confirm the vulnerability exists in that FileRun release and describe the root cause as improper handling of the ffmpeg bina...

CVE-2021-35503

CVE-2021-35503 affects Afian FileRun 2021.03.26. The issue is a stored XSS caused by mishandling of the HTTP X-Forwarded-For header when rendering Activity Logs, implying user-supplied header data could be reflected in logs and executed in the browser. The description identifies the affected comp...

Afian FileRun 注入漏洞

Afian FileRun is a full-featured web-based file manager. A security vulnerability exists in Afian FileRun 2021.03.26 that allows remote code execution via the Check Path value of ffmpeg binaries...

Afian FileRun 注入漏洞

Afian FileRun is a full-featured web-based file manager. A security vulnerability exists in Afian FileRun 2021.03.26 that allows remote code execution...

Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Filerun 2021.03.26 - Remote Code Execution RCE Authenticated Date: 09/21/2021 Exploit Author: syntegris information solutions GmbH Credits: Christian P. Vendor Homepage: https://filerun.com Software Link:...