3 matches found
CVE-2017-8832
Allen Disk 1.6 has XSS in the id parameter to downfile.php.
CVE-2017-8848
Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.
CVE-2017-9307
SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.