PT-2022-8012 · Tecrail · Tecrail Responsive Filemanager

Name of the Vulnerable Software and Affected Versions: Tecrail Responsive Filemanger versions up to 9.10.x Description: A critical vulnerability was found in Tecrail Responsive Filemanger, allowing for path traversal. The attack can be launched remotely. The issue has been disclosed publicly and...

Tecrail Responsive File Manager path traversal vulnerability

Tecrail Responsive Filemanger is a free open source file manager and image manager from Tecrail Italy. A security vulnerability exists in Tecrail Responsive Filemanger version 9.11.0 and earlier versions, which can be exploited by an attacker to copy, cut any file...

CVE-2013-1891

In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed...

Design/Logic Flaw

In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed...

CVE-2017-20063

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgradi...

PT-2022-7936

Name of the Vulnerable Software and Affected Versions Elefant CMS version 1.3.12-RC Description A critical issue has been found in the File Upload component, specifically affecting an unknown function of the file /filemanager/upload/drop. This issue leads to improper privilege management and can ...

CVE-2017-20063: Improper Privilege Management

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgradi...

GHSA-G2X4-256V-5PVX Codiad Cross-site Scripting Vulnerability

A Cross Site Scripting XSS vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by co...

PT-2022-19352

Name of the Vulnerable Software and Affected Versions CSZCMS version 1.3.0 Description The issue allows attackers to execute a Server-Side Request Forgery SSRF which can be leveraged to leak sensitive data via a local file inclusion at "/admin/filemanager/connector/". Recommendations For CSZCMS...

CVE-2022-28997: Server-Side Request Forgery (SSRF)

CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery SSRF which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/...

CSZCMS Code Issues and Vulnerabilities

CSZCMS is an open source web application that allows managing all content and settings on a website. A security vulnerability exists in CSZCMS version 1.3.0 that originates from the leakage of sensitive data via local files in /admin/filemanager/connector/...

Elefant CMS Code Execution Vulnerability

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

GHSA-77J2-7WHR-6VPX Elefant CMS Code Execution Vulnerability

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters for bypassing the...

CSZCMS 1.3.0 SSRF / LFI / Remote Code Execution Vulnerabilities

Title: CSZCMS V1.3.0 - SSRF To LFI To Rce Author: Hejap Zairy Vendor: https://sourceforge.net/projects/cszcms/files/install/ Software: https://liquidtelecom.dl.sourceforge.net/project/cszcms/install/CSZCMS-V1.3.0.zip Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache 1 -...

CVE-2022-22914

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

Path traversal

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

CVE-2022-22914

CVE-2022-22914 affects Ovidentia CMS 6.0 FileManager. The issue is an incorrect access control that permits an authenticated attacker to view and download files in the upload directory via path traversal. Underlying cause: insufficient restriction on file paths in FileManager. Impact: exposure of...

Ovidentia path traversal vulnerability

Ovidentia is an open source content management system and collaboration platform based on PHP and MySQL from the French team CANTICO Cantico, which can be used for publishing and managing projects, publication and article management, schedule sharing, and more. A path traversal vulnerability exis...

CVE-2022-22914: Improper Limitation of a Pathname to a Restricted Directory

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal...

PT-2022-15732

Name of the Vulnerable Software and Affected Versions Ovidentia CMS version 6.0 Description An issue with access control in the FileManager component allows authenticated attackers to view and download content in the upload directory via path traversal. Recommendations For Ovidentia CMS version...