CVE-2015-2324

CVE-2015-2324 is a Cross-Site Scripting (XSS) vulnerability in the WordPress Photo Gallery plugin’s filemanager, affecting versions before 1.2.13. The issue permits remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors. Exploitation details...

Rich FileManager 2.7.0 Cross Site Scripting

============================================================================================================================ | Title : Rich FileManager v2.7.0 xss via file uploads Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro | | | Vend...

CVE-2017-1000490

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to...

Design/Logic Flaw

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to...

CVE-2017-1000490

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to...

CVE-2017-1000490

Summary: Mautic 1.0.0–2.11.0 is vulnerable to arbitrary file download via the Filemanager by any authenticated session. The root cause is a flaw in the Filemanager access control that allows a logged-in user to download files the web server user can access. Impact: Confidentiality of arbitrary se...

CVE-2017-14921

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

CVE-2017-14921

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

Cross site scripting

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

CVE-2017-14921

CVE-2017-14921 is a stored XSS in the Filemanager component of Tine 2.0 Community Edition prior to 2017.08.4. An authenticated user can inject JavaScript via an IMG element in the Filename field, which is rendered by the admin/viewer context and by other users, enabling script execution. The vuln...

CVE-2017-14921

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

Remote Command Execution (RCE)

Codiad is vulnerable to remote code execution RCE attacks. A malicious user can embed shell commands in parameter values sent to components/filemanager/class.filemanager.php and execute them...

CVE-2017-11366

components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by searchfiletype...

Design/Logic Flaw

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

Arbitrary File Upload Vulnerability in Pixie CMS Backend

Pixie CMS is a full-featured and easy-to-use website builder. An arbitrary file upload vulnerability exists in the Pixie CMS backend modfilemanager.php file $multiupload-extensions. An attacker can use this vulnerability to upload arbitrary files and execute arbitrary code...

Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

Picosafe Web Gui - Multiple Vulnerabilities

Exploit for php platform in category web applications - Title : Picosafe Web Gui - Multiple Vulnerabilities - Author : Shahab Shamsi - Vendor : https://github.com/embeddedprojects/picosafewebgui - Category : Webapps - Date : 01.October.2016 Vulnerable page :...