CVE-2019-19658

CVE-2019-19658 Chevereto stored XSS in profile page - 1.0.0 - 1.1.4 Free, Registered user injects some script into the name field, in this case to redirect the user to Google Someone enters the profile of /test and is then redirected...

CVE-2019-19511

CVE-2019-19511 Chevereto - 1.0.0 Free - 1.1.4 Free, = 3.13.4 Core, Remote Code Execution Description installer.php in Chevereto through 1.1.4 Free, and through 3.13.4 Core, allows remote authenticated admins to execute arbitrary PHP code by injecting this code into the setup process and overwriti...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...

CVE-2019-19633

CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...

CVE-2019-19653

CVE-2019-19653 Chevereto information disclosure = 3.13.5 Core. Log files for the bulk importer are available for anyone to see and are easily enumerated /app/importer/jobs/9/process.txt /app/importer/jobs/9/errors.txt...

CVE-2019-19654

CVE-2019-19654 Chevereto denial of service - = 3.13.5 Core in the /dashboard/bulk tool. An attacker with an admin account can insert any path. The bulk importer will remove any file and folder it has access to. Basically you can make the website self-destruct. Add job to "import" /var/www/html PO...

CVE-2019-19651

CVE-2019-19651 Chevereto reflected XSS in Website Name, doctitle, and description - 1.0.0 - 1.1.4 Free, Settings - Website name, Website doctitle, Website description Putting this in will reflect on the whole site for all the users "ChevtChevt...

CVE-2026-122326

A flaw was found in Chevereto. An improper authorization check in the album listing endpoint allows an unauthenticated remote attacker to access private albums. By supplying an album identifier alongside a public session token, an attacker can retrieve image filenames, view direct file links, and...

CVE-2026-122326

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded i...

CVE-2026-122326 Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded i...

CVE-2026-122326 Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded i...

EUVD-2026-117534

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded i...

CVE-2026-122326

Chevereto versions before 4.5.8 are vulnerable to an authorization bypass in the get-album-contents action of the /json route. This flaw allows unauthenticated attackers to access private albums by providing another user's album ID. Specifically, an attacker possessing a session token from any pu...

Chevereto detect

Detects Chevereto detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Chevereto detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Chevereto detect', 'description': 'Detects Chevereto detect.'...

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

CVE-2026-55417 Chevereto private profile setting leaks username on /json endpoint

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

CVE-2026-55417 Chevereto private profile setting leaks username on /json endpoint

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

EUVD-2026-42085

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

CVE-2026-55417 Chevereto private profile setting leaks username on /json endpoint

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...