CVE-2026-117566

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

EUVD-2026-110844

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566

EasyImages versions 2.0 through 2.8.6 are vulnerable to an unauthenticated path traversal vulnerability in the app/down.php , app/thumb.php , and app/info.php components. The root cause is the improper limitation of pathnames, where attackers can supply ../ sequences in the dw , history , or img ...

CVE-2026-117566

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

icret EasyImages path traversal vulnerability

icret EasyImages versions 2.8.6 and earlier contain a path traversal vulnerability. This vulnerability stems from unvalidated path traversal in app/down.php, app/thumb.php, and app/info.php. Attackers can exploit this by providing ../ sequences in the dw, history, or img parameters, thereby readi...

PT-2026-126425

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2018-25439 MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

CVE-2018-25439 MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

CVE-2018-25439

MetInfo CMS versions 6.0.0 before 6.1.1 are vulnerable to a path traversal vulnerability in the /include/thumb.php component. The root cause is an inadequate filter where attackers can use backslash sequences to bypass the str_replace function, allowing unauthenticated remote attackers to read ar...

MajorDoMo thumb.php - OS Command Injection Detection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo aka Major Domestic Module before 0662e5e allows command execution v...

CVE-2023-50917

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager...

EUVD-2009-3520

Malware in sbrugna...

CVE-2024-33465

Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component...

CVE-2024-33465

Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component...

CVE-2024-33465

Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component...

PT-2024-25273 · Majordomo · Majordomo

Name of the Vulnerable Software and Affected Versions: MajorDoMo versions prior to 0662e5e Description: The issue allows an attacker to escalate privileges via the thumb/thumb.php component. This is a Cross Site Scripting vulnerability. Recommendations: For versions prior to 0662e5e, update to...

CVE-2024-33465: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component...