PT-2019-15822

Name of the Vulnerable Software and Affected Versions Rumpus FTP Web File Manager version 8.2.9.1 Description A Reflected Cross Site Scripting issue was found in the Login page, allowing an attacker to execute arbitrary Javascripts by sending a crafted link to end users. Recommendations For Rumpu...

CVE

CVE's for Rumpus FTP Server Ven...

Exploit for Cross-site Scripting in Maxum Rumpus

CVE's for Rumpus FTP Server Ven...

nopCommerce Cross-Site Request Forgery Vulnerability

nopCommerce is an open source e-commerce shopping cart software. roxy Fileman is a free open source file browser for .NET and PHP , can be integrated into the CKEditor and TinyMCE WYSIWYG html editor . A cross-site request forgery vulnerability exists in Roxy Fileman used in nopCommerce 4.2.0,...

Responsive File Manager Directory Traversal (CVE-2018-20792)

A directory traversal vulnerability exists in the Responsive File Manager. This vulnerability is due to insufficient sanitization of directory traversal characters by the ajaxcalls.php. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected...

CVE-2019-16295

Stored XSS in filemanager2.php in CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.885 exists via the cmdarg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim...

CWP 0.9.8.885 Cross Site Scripting

Exploit Title: CWP CentOS Control Web Panel Store Cross Site Scripting Date: 25 Oct 2019 Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.885 CVE : CVE-2019-16295 +++++++++++++++++++++++++++++++++...

CVE-2019-17629

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17629

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

Design/Logic Flaw

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17629

CMS Made Simple (CMSMS) 2.2.11 is affected by a stored cross‑site scripting (XSS) flaw. An admin can inject malicious content via a crafted image filename in the file manager > upload images screen, which is stored and later rendered in the application. The root cause is not explicitly detaile...

CVE-2019-17629: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

PT-2019-15237

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 2.2.11 Description The issue allows for stored XSS by an admin via a crafted image filename on the "file manager upload images" screen. Recommendations For version 2.2.11, update to a newer version that contains a fix...

Fly-start-panel Component Unauthorized Access

The vulnerability of the fly-start-panel component in the FLY operating system environment of the Astra Linux system is related to the ability to switch to a higher level in the file system through the “Start Menu” and file manager programs. Exploiting this vulnerability can allow an intruder to...

CVE-2019-11380

The CVE-2019-11380 issue affects the Android app ES File Explorer File Manager (version 4.2.0.1.3). The master-password protection can be bypassed via the com.estrongs.android.pop.ftp.ESFtpShortcut intent, which leads to remote FTP access to the user’s entire local storage. This vulnerability is ...

PT-2019-12270

Name of the Vulnerable Software and Affected Versions ES File Explorer File Manager application version 4.2.0.1.3 Description The master-password feature in the ES File Explorer File Manager application can be bypassed, allowing remote FTP access to the entirety of local storage. This can be...

CVE-2019-11380: Undefined Security Weakness

The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortcut intent, leading to remote FTP access to the entirety of local storage...

Cross-site Scripting (XSS)

Bolt is vulnerable to cross-site scripting XSS. The vulnerability exists due to lack of proper handling of Create file for system log in file manager, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...

CVE-2019-15091

filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload...

CVE-2019-13385

CVE-2019-13385 affects CentOS Web Panel 0.9.8.840 (CWP). The vulnerability is an Information Disclosure in the filemanager component, allowing an attacker to enumerate users and identify active users by reading the /tmp/login.log. The exploitation context observed in external sources confirms use...