CVE-2026-12513

CVE-2026-12513: Shared Files 1.7.68 — Unauthenticated Arbitrary File Deletion via Path Traversal 📖 Advisory Overview CVE-2026-12513 is an unauthenticated Arbitrary File Deletion vulnerability via Path Traversal affecting the Shared Files and Shared Files Pro WordPress plugins before version 1.7.6...

Mazin Al Saadi 3D Viewer for Nextcloud authorization issue vulnerability

The Mazin Al Saadi 3D Viewer for Nextcloud versions 1.7.9 through 3.3.2 contain an authorization issue vulnerability. This vulnerability arises because the public file endpoint fails to perform proper sharing authorization checks. Additionally, PublicFileController does not inherit from...

Zimbra Collaboration Suite digital error vulnerability

Versions 10.1.16 and 10.1.20 of the Zimbra Collaboration Suite contain a numerical error vulnerability. This vulnerability stems from improper handling of mailbox quotas; when creating shared files, the document size is included in the total mailbox usage. Upon revocation, only the record is...

CVE-2026-111332

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

AtalayaLabs OxiCloud Authorization Issue Vulnerability

The AtalayaLabs OxiCloud versions 0.9.1 to 0.9.3 have an authorization issue vulnerability. This vulnerability stems from improper authorization handling. Attackers can access shared files or folder contents by making a GET /api/files/id request, even after password protection has been applied...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability in SHIRASAGI groupware allows an attacker with low privileges to retrieve files from the shared file feature by manipulating a user-controlled key. The root cause is the reliance on a user-supplied key for access control in the shared file module, enabling un...

WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...

WordPress Shared Files Plugin Server-side Request Forgery Vulnerability

The WordPress Shared Files Plugin is a plugin designed for listing, managing, and sharing files on WordPress websites. The WordPress Shared Files Plugin has a server-side request forgeing vulnerability. This vulnerability arises from insufficient validation mechanisms implemented by the server to...

Exploit for CVE-2026-12513

CVE-2026-12513: Shared Files Quick Links: Explore the res...

WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files versions 1.7.67...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files versions 1.7.67...

WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files Pro versions 1.7.70...

CVE-2026-19084

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

CVE-2026-12513

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...