82 matches found
CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358
LavaLite CMS versions through 10.1.2 are vulnerable to a missing authentication flaw in the Filer module . This vulnerability allows unauthenticated attackers to access the filer/download and filer/display routes. By providing arbitrary disk names and paths to the FileController , an attacker can...
EUVD-2026-104929
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
PT-2026-118342
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-54459
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
EUVD-2026-97978
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
CVE-2026-54459
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
PT-2026-110987
Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.14.0 Description Cross-Site Request Forgery CSRF occurs because the application fails to enforce server-side token checks for specific state-changing operations. The POST endpoints '/api/file/createFile.php' and...
CVE-2026-54459: Cross-Site Request Forgery (CSRF)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
EUVD-2026-88582
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...
CVE-2026-102366
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...
CVE-2026-102366: Unrestricted Upload of File with Dangerous Type
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...
CVE-2026-102366
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...
CVE-2026-102366
The mall4j application (versions through 4.0 ) is vulnerable to an unrestricted file upload in its FileController endpoints. The root cause is a lack of authorization checks and insufficient validation of file types. An attacker possessing any authenticated token can upload HTML or SVG files to t...