CVE-2026-88288

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

PT-2025-26487 · Unknown · Code-Projects Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: code-projects Simple Online Hotel Reservation System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /add reserve.php. The manipulation of the firstname argument leads to SQL...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

Cross-Site Scripting (XSS)

studio-42/elfinder is vulnerable to persistent Cross-site Scripting XSS. The vulnerability is due to a filename restriction bypass, allowing attackers to inject malicious scripts...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

CVE-2023-52045

Studio-42 eLfinder version 2.1.62 is vulnerable to a persistent Cross-site Scripting (XSS) vulnerability due to an improper file name sanitization that allows for a filename restriction bypass. An attacker can inject malicious scripts into web pages viewed by other users by uploading a specially ...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

CVE-2023-52045: Improper Neutralization of Input During Web Page Generation

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

PT-2024-14374

Name of the Vulnerable Software and Affected Versions Studio-42 eLfinder version 2.1.62 Description The issue is related to a filename restriction bypass, leading to a persistent Cross-site Scripting XSS vulnerability. This vulnerability allows bypassing filename restrictions, which can result in...

CVE-2023-52045

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...

elFinder security vulnerability

elFinder is an open source web file manager from Studio 42 Open Source. A security vulnerability exists in elFinder version 2.1.62, which stems from the inclusion of a filename restriction bypass vulnerability that can lead to a persistent cross-site scripting vulnerability...

Unrestricted Logging Filename Lead to RCE

Description This vulnerability occur because there is no filename restriction for saving logging file. In this case attacker can set the filename to existing php file and append php code on it by manipulating the logged input. Proof of Concept 1. Log in using operator account, in this case i try ...

CVE-2021-21698

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent...

CVE-2017-9061

In WordPress before 4.7.5, a cross-site scripting XSS vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename...

CVE-2015-5719

app/Controller/TemplatesController.php in Malware Information Sharing Platform MISP before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors...

PT-2016-3694

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.3.92 Description The issue is related to the improper restriction of filenames under the tmp/files/ directory in the Malware Information Sharing Platform MISP. The impact and attack vectors of this issue are not...