523 matches found
Studio 42 elFinder 跨站脚本漏洞
Studio 42 elFinder is an open source web file manager that uses jQuery and jQuery UI and is written in JavaScript. A cross-site scripting vulnerability exists in Studio 42 elFinder that stems from the product's failure to securely handle SVG document data. The vulnerability can be exploited to...
CVE-2021-45919: Improper Neutralization of Input During Web Page Generation
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
ElFinder File Manager Command Injection (CVE-2021-32682)
A command injection vulnerability exists in ElFinder. The vulnerability is due to insufficient validation of the file name when creating an archive...
CVE-2021-32172
Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...
CVE-2021-32172
Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...
Improper access control
Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...
CVE-2021-32172
The e-commerce system Maian Cart (versions 3.0 to 3.8 ) is vulnerable to Remote Code Execution (RCE) due to a broken access control issue in the Elfinder file manager plugin . An unauthenticated attacker can exploit this flaw to execute arbitrary code on the affected system. Publicly available ex...
CVE-2021-32172
Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...
CVE-2021-32172: Missing Authorization
Maian Cart v3.8 contains a preauthorization remote code execution RCE exploit via a broken access control issue in the Elfinder plugin...
Maian Script World Maian Cart 安全漏洞
Maian Script World Maian Cart is a powerful e-commerce system from Maian Script World, UK. A security vulnerability exists in Maian Cart v3.8, which stems from an access control issue in the Elfinder plugin...
Metasploit Wrap-Up
Clone your way to code execution We’ve had a busy week bringing you exploits, features, enhancements, and fixes. Exploit modules for Git and El Finder lead the pack this week with an information disclosure against Jira and a post exploitation module targeting Geutebruck white-labelled cameras to...
elFinder Archive Command Injection Exploit
elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT...
elFinder Archive Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder Archive Command Injection', 'Description' = %q elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via it...
CVE-2021-23428
This affects all versions of package elFinder.NetCore. The Path.Combine... method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal...
elFinder 输入验证错误漏洞
elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling, and other features. A security vulnerability exists in all versions of elFinder.NetCore in Snyk. The vulnerability is due to a lack of checking of user input and...
elFinder 路径遍历漏洞
elFinder is a set of Drupal-based platform , open source AJAX file manager . The product provides multiple file uploads, image scaling, and other features. NetCore A path traversal vulnerability exists in elFinder.NetCore , the vulnerability stems from all versions of elFinder.NetCore due to...
Directory Traversal
Overview elFinder.NetCore is a file manager for Web. Affected versions of this package are vulnerable to Directory Traversal. The Path.Combine... method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to...
elFinder - A Case Study of Web File Manager Vulnerabilities
An application’s interaction with the file system is always highly security sensitive, since minor functional bugs can easily be the source of exploitable vulnerabilities. This observation is especially true in the case of web file managers, whose role is to replicate the features of a complete...
Path Traversal in elFinder.Net.Core
This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path...
