Studio 42 elFinder allows stored XSS

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

GHSA-C3J8-Q5X6-2855 Studio 42 elFinder allows stored XSS

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

Design/Logic Flaw

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

CVE-2021-45919

Studio 42 elFinder versions up to 2.1.31 are affected by a cross-site scripting (XSS) vulnerability involving SVG data handling. The vulnerability stems from insecure handling of SVG document data, enabling client-side code execution. Affected product is elFinder (Studio 42), with the issue docum...

CVE-2021-45919

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

PT-2022-12469

Name of the Vulnerable Software and Affected Versions Studio 42 elFinder versions 2.1.31 and earlier Description The issue allows for XSS via an SVG document. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incident...

CVE-2021-45919: Improper Neutralization of Input During Web Page Generation

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...

Remote Code Execution

studio-42/elfinder is vulnerable to remote code execution. An attacker is able to execute arbitrary code and commands on the server hosting the elFinder PHP connector even with the minimal configuration...

CVE-2021-23394

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

Remote code execution

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394

The studio-42/elfinder web file manager before version 2.1.58 is vulnerable to Remote Code Execution (RCE) . The root cause is an insufficient upload filter that fails to disallow the upload of .phar files. If the underlying web server (such as certain Apache or Nginx configurations) parses these...

CVE-2021-23394 Remote Code Execution (RCE)

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

CVE-2021-23394: Unrestricted Upload of File with Dangerous Type

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP...

elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder PHP Connector exiftran Command Injection', 'Description' = %q This module exploits a command injection vulnerability in elFinder version...

Information Disclosure

studio-42/elfinder is vulnerable to information disclosure. An attacker is able to obtain confidential information when the PHP's curl extension, and when safemode or openbasedir is not configured...

Directory Traversal

studio-42/elfinder is vulnerable to directory traversals. The application does not properly validate the file parameter in the zipdl function of elFinder.class.php, allowing a malicious user to conduct a directory traversals attack, and may cause file deletion. This vulnerability exists due to an...

Studio 42 elFinder Directory Traversal Vulnerability

Studio 42 elFinder is an open source Web file manager using jQuery and jQuery UI and written in JavaScript . A directory traversal vulnerability exists in Studio 42 elFinder. An attacker can exploit this vulnerability by deleting files with the 'zipdl' function in the elFinder.class.php file...

CVE-2018-9110

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...