70 matches found
CVE-2025-25279
Sicherheitshinweis MMSA-2025-00430 / CVE-2025-25279 Zusammenfassung Nach dem Hochladen einer Datei in Mattermost Boards zeigt die Datei, wenn der fileId-Parameter geändert und das Board kopiert wird, nun auf die im Parameter angegebene Zieldatei und lädt diese herunter. Betroffene Versionen:...
CVE-2025-4578
CVE-2025-4578 File Provider = 1.2.3 - Nicht authentifizierte SQL-Injection Beschreibung Das File Provider Plugin für WordPress ist in allen Versionen bis einschließlich 1.2.3 anfällig für SQL-Injection über den Parameter 'fileId' aufgrund unzureichender Maskierung des benutzerbereitgestellten...
CVE-2026-53536
Activepieces (open source AI workflow automation) exposed a cross-tenant file exposure vulnerability prior to version 0.83.0. The /v1/step-files/signed download endpoint validated the JWT against the shared signing secret but did not check the token’s audience and, due to a missing null-check on ...
CVE-2026-45277 Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2...
CVE-2026-45277 Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, authenticated users can check if arbitrary files are associated with specific approval workflows where they can request approval. This issue has been patched in version 2.7.2...
GHSA-5H3G-PX23-W6VW Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Summary The fileID field from Manifest.db a SQLite database inside iOS backups, generated by the device is used directly in filesystem path construction without validation. This affects two commands through a shared code path: - mvt-ios decrypt-backup decrypt.py: fileid is used to construct both...
PT-2026-42664
Name of the Vulnerable Software and Affected Versions MVT Mobile Verification Toolkit versions prior to 2026.5.12 Description A path traversal issue exists during iOS Backup processing due to unsanitized file identifiers. The fileID field from the Manifest.db SQLite database is used directly in...
fileId parameter reveals workflow associations in Nextcloud Approval app
None...
VulnCheck KEV: CVE-2023-3793
A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql...
EUVD-2025-203106
Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference IDOR in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such...
CVE-2025-64011
Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference IDOR in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such...
CVE-2025-13787
ZenTao up to 21.7.6-8564 is affected by a privilege-management flaw in the File Handler’s file::delete function (module/file/control.php). Manipulating the fileID parameter can lead to improper privilege handling, with remote exploit potential. All published references indicate upgrading to versi...
CVE-2025-13787 ZenTao File control.php delete privileges management
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack...
Nature Easy Soft Network Technology ZenTao 安全漏洞
Nature Easy Soft Network Technology ZenTao is a set of open source project management software from China's Nature Easy Soft Network Technology Nature Easy Soft Network Technology. The software includes product management, project management, quality management and document management functions. ...
WordPress plugin Frontend File Manager 安全漏洞
WordPress Frontend File Manager Plugin is a plugin that allows users to upload, manage and share files through a frontend interface that supports secure storage and permission control. WordPress Frontend File Manager Plugin suffers from an insecure direct object reference vulnerability that stems...
EUVD-2016-9908
Malware in sbrugna...
EUVD-2020-19703
Malware in sbrugna...
EUVD-2006-1098
Malware in sbrugna...