PT-2026-60509

Name of the Vulnerable Software and Affected Versions LogicalDOC Enterprise versions prior to 9.1.2 Description An authenticated user can exploit a Local File Inclusion LFI flaw in the OnlyOfficeEditor servlet class. By utilizing path traversal in the fileExt parameter, an attacker can gain...

CVE-2025-45870

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

CVE-2025-45870

LogicalDOC Enterprise (up to and including version 9.1.1) is susceptible to a Local File Inclusion (LFI) vulnerability within the OnlyOfficeEditor servlet class . An authenticated user can exploit path traversal flaws specifically in the fileExt parameter. Successful exploitation allows the attac...

EUVD-2025-210478

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

PT-2023-12283 · Unknown · Portfoliocms

Name of the Vulnerable Software and Affected Versions: portfolioCMS version 1.0 Description: A race condition issue allows remote attackers to execute arbitrary code by exploiting the fileExt parameter in the localhost/admin/uploads.php API endpoint. Recommendations: For portfolioCMS version 1.0,...

portfolioCMS 竞争条件问题漏洞

PortfolioCMS is Bootstrap portfolio website with admin panel. A competitive condition vulnerability exists in portfolioCMS version 1.0.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the fileExt parameter of localhost/admin/uploads.php...

CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1 Update-3 i.e.; 8.1 rev. 160519 CVE : CVE-2019-13493 Vendor...