CVE-2026-44260

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the "efw:elFinder" efw:elFinder JSP tag is intended to prevent file modifications. When protected=true, elfindercheckRisk enforces that the client sends readonly=true matching the session value, but no event...

CVE-2026-44260

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the JSP tag is intended to prevent file modifications. When protected=true, elfindercheckRisk enforces that the client sends readonly=true matching the session value, but no event handler checks the readonly...

CVE-2026-44260: Incorrect Authorization

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the JSP tag is intended to prevent file modifications. When protected=true, elfindercheckRisk enforces that the client sends readonly=true matching the session value, but no event handler checks the readonly...

CVE-2024-52318

Apache Tomcat versions 11.0.0 , 10.1.31 , and 9.0.96 are affected by an incorrect object recycling and reuse vulnerability (CVE-2024-52318). In generated JavaServer Pages (JSP), this issue arises from improper resource release, which can lead to inadequate output escaping. This flaw allows attack...