CVE-2026-47230

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230

Summary: CVE-2026-47230 in Admidio exposes an IDOR vulnerability in the documents-files.php rename flow. The top-level rights check validates upload rights on the folder_uuid, but the actual rename uses file_uuid via getFileForDownload with no verification of the file’s source folder. This allows...

CVE-2026-47230: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47231: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-47226: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of modules/documents-files.php evaluates...

CVE-2026-54416: Unrestricted Upload of File with Dangerous Type

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

CVE-2026-41656: Improper Limitation of a Pathname to a Restricted Directory

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type HTML encoding, allowing path traversal characters ../ to pass through unfiltered. Combined with the absence of CSRF...

EUVD-2018-19194

Malware in sbrugna...

EUVD-2016-1729

Malware in sbrugna...

EUVD-2022-39449

Malicious code in bioql PyPI...

CVE-2022-36749

RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file...

PT-2024-30053 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.0 Description: The issue is related to a remote code execution vulnerability. Although the admin files.php file imposes restrictions on edited files, attackers can bypass these restrictions and write code. This allows...

CVE-2005-10002: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sfdownloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able t...

CVE-2022-36749

RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file...

CVE-2022-36749

RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file...

PT-2022-23602 · Unknown · Rpi-Jukebox-Rfid

Name of the Vulnerable Software and Affected Versions: RPi-Jukebox-RFID version 2.3.0 Description: A command injection issue was discovered in the /htdocs/utils/Files.php component. This issue is exploited via a crafted payload injected into the file name of an uploaded file. Recommendations: For...