382 matches found
CVE-2019-10046
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information...
CVE-2019-15032
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server informatio...
CVE-2019-10045
The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is...
CVE-2019-10049
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...
CVE-2019-10047
A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...
CVE-2018-1999017
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...
CVE-2018-1999016
Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...
CVE-2019-9642
An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a...
CVE-2018-1999018
Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution RCE vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow$nodeObject that can result in An attacker gaining admin access and can then execute arbitrary commands on the...
Pydio Core End of Life (EOL) Detection
The Pydio Core version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Pydio Core <= 8.2.5 XSS Vulnerability
Pydio Core is prone to a cross-site scripting XSS vulnerability via the New URL Bookmark feature. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...
CVE-2024-40124
Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...
CVE-2024-40124
Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...
CVE-2024-40124
Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...
PT-2025-17202 · Unknown · Pydio Core
Name of the Vulnerable Software and Affected Versions: Pydio Core versions 8.2.5 and earlier Description: The issue is related to Cross Site Scripting XSS via the New URL Bookmark feature. This allows for potential malicious script execution. Recommendations: For Pydio Core versions 8.2.5 and...
CVE-2024-40124
Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...
CVE-2024-40124
Pydio Core = 8.2.5 is vulnerable to Cross Site Scripting XSS via the New URL Bookmark feature...
CVE-2024-40124
Summary (CVE-2024-40124): Pydio Core versions up to 8.2.5 are vulnerable to a cross-site scripting (XSS) flaw in the New URL Bookmark feature. The issue is confirmed across multiple sources (OpenVAS, Red Hat, CVE records). Remediation: upgrade to a version later than 8.2.5 or apply the hotfix/pat...
Pydio Core 安全漏洞
Pydio Core is a document sharing and collaboration platform core program from Pydio, Inc. A security vulnerability exists in Pydio Core 8.2.5 and earlier versions, which stems from a cross-site scripting vulnerability in the New URL Bookmark feature...