523 matches found
CVE-2022-26960
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths...
CVE-2022-26960
CVE-2022-26960 affects elFinder
elFinder 路径遍历漏洞
elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling, and other features. A path traversal vulnerability exists in versions prior to elFinder 2.1.60, which stems from improper handling of absolute file paths. An...
CVE-2022-26960: Improper Limitation of a Pathname to a Restricted Directory
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths...
Library File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion
The plugin is using an outdated version of the elFinder library, which is know to be affected by security issues CVE-2021-32682, and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, a...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
Remote code execution
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
CVE-2021-44663
The CVE-2021-44663 vulnerability affects Xerte Project (Xerte) up to version 3.8.4, where remote code execution can be triggered via a crafted PHP file uploaded through elfinder in connector.php. The underlying issue enables network-exposed RCE with high impact (as indicated by CVSS scores in the...
CVE-2021-44663: Undefined Security Weakness
A Remote Code Execution RCE vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php...
Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
GHSA-C3J8-Q5X6-2855 Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
Design/Logic Flaw
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder versions up to 2.1.31 are affected by a cross-site scripting (XSS) vulnerability involving SVG data handling. The vulnerability stems from insecure handling of SVG document data, enabling client-side code execution. Affected product is elFinder (Studio 42), with the issue docum...