CVE-2019-12905

FileRun 2019.05.21 is affected by a cross-site scripting vulnerability that can be triggered when a filename is crafted during uploads to the path ?module=fileman&section=do&page=up. The issue arises from processing the uploaded filename, allowing an attacker-controlled script to be reflected to ...

CVE-2022-30470

CVE-2022-30470 affects Afian FileRun (version 20220202) where changing the "search_tika_path" to a custom (previously uploaded) jar enables remote code execution in the webserver user context. The vulnerability originates from how the application loads an externally supplied jar via the search_ti...

CVE-2022-30469

Afian FileRun 20220202 is affected by an SQL injection vulnerability caused by lack of sanitization of the POST parameter metadata[] in the grid page (/ ?module=fileman&section=get&page=grid). The issue is confirmed across multiple sources (NVD entry CVE-2022-30469, Red Hat advisory, CNVD, CVE li...

CVE-2019-12458

CVE-2019-12458 affects FileRun; the 2019.05.21 release is vulnerable to a css/ext-ux Directory Listing issue. The vulnerability is resolved in FileRun 2019.06.01 . Documents do not provide exploitation specifics or root-cause details beyond the listing exposure. Impact is described as potential d...

CVE-2021-35506

CVE-2021-35506 affects Afian FileRun 2021.03.26 and is a cross-site scripting (XSS) issue triggered when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. Multiple connected sources (Red Hat, NVD/CVE record, CNNVD, PRION) corroborate that t...

CVE-2021-35505

CVE-2021-35505 affects Afian FileRun 2021.03.26. The vulnerability enables Remote Code Execution by administrators via the Check Path value for the magick binary. The description identifies a path/command handling issue in the magick binary check, leading to code execution with the attacker’s cho...

CVE-2019-12457

CVE-2019-12457 affects FileRun (version 2019.05.21) and allows directory listing of images/extjs. Root cause is not fully detailed in the provided documents, but the issue has been fixed in FileRun 2019.06.01. The CVE entry is corroborated by multiple sources (NVD, Red Hat advisory) and CNVD/CVEL...

CVE-2021-35503

CVE-2021-35503 affects Afian FileRun 2021.03.26. The issue is a stored XSS caused by mishandling of the HTTP X-Forwarded-For header when rendering Activity Logs, implying user-supplied header data could be reflected in logs and executed in the browser. The description identifies the affected comp...

CVE-2023-28876

The CVE-2023-28876 issue affects Filerun up to Update 20220202, describing a Broken Access Control in comments on uploaded files that allows an attacker to delete comments on files uploaded by other users. The available connected records confirm the affected product (Filerun) and the impact on co...

CVE-2018-7734

Afian FileRun is affected by a remote SQL injection in versions prior to 2018-02-13. The issue occurs when an attacker is logged in as superuser and uses the search parameter in the /?module=users&section=cpanel&page=list request to inject SQL commands. Root cause: improper input handling in the ...

CVE-2021-35504

CVE-2021-35504 affects Afian FileRun 2021.03.26 and enables Remote Code Execution (RCE) via the Check Path value used for the ffmpeg binary. The Red Hat and CVE/NVD entries confirm the vulnerability exists in that FileRun release and describe the root cause as improper handling of the ffmpeg bina...

CVE-2018-7735

CVE-2018-7735 describes a remote SQL injection in Afian FileRun (pre-2018.02.13) exploitable when logged in as superuser via the search parameter in the URL path /?module=metadata&section=cpanel&page=list_filetypes. The issue stems from input in the search parameter that is used in SQL without pr...

CVE-2019-12459

CVE-2019-12459 describes a directory listing vulnerability in FileRun 2019.05.21 related to customizables/plugins/audio_player. Multiple sources (NVD, Red Hat, CNVD) corroborate that the issue exists in FileRun and was fixed in 2019.06.01. The Red Hat entry and other records align on the same des...

CVE-2023-28875

CVE-2023-28875 concerns a stored XSS in FileRun’s shared files download terms, specifically affecting Filerun Update 20220202. The vulnerability is triggered when a user follows a crafted share link, allowing injected JavaScript code execution in the victim’s browser. Connected sources identify t...