CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842

A vulnerability exists in the KCFinder File Manager component of gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8). The root cause is located in the app_user_login_model.php::cekUserLogin function within the application/models/app_user_login_model.php file, wh...

EUVD-2026-89543

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102842: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

PT-2026-102962

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app user login model.php::cekUserLogin of the file application/models/app user login model.php of the component KCFinder File Manager. Such...

WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability

Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...

WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...

WordPress File Manager plugin < 8.0.5 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin Bit File Manager versions 8.0.5...

[SECURITY] Fedora 45 Update: nemo-6.7.8^unstable-1.fc45

Nemo is the file manager and graphical shell for the Cinnamon desktop that makes it easy to manage your files and the rest of your system. It allows to browse directories on local and remote filesystems, preview files and launch applications associated with them. It is also responsible for handli...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-19708

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

CVE-2026-85081

Multiple WordPress plugins—File Manager (before 8.0.5), FileOrganizer (before 1.2.1), and File Manager Pro (before 2.1.3)—are vulnerable to a DOM-based XSS due to improper validation of postMessage origins. The flaw exists in the bundled file-manager library (versions below 2.1.70), where the app...

EUVD-2026-87534

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-19708 File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

CVE-2026-19708 File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

EUVD-2026-87530

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

CVE-2026-19708

The File Manager WordPress plugin (versions 7.2.2-8.0.4 ) contains a vulnerability where unauthenticated users can download database backup archives. This occurs because the plugin fails to prevent unauthorized access and, in some instances, uses a fixed filename for these backups. On servers tha...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...