Roxy Fileman Security Vulnerabilities and Issues — Roxy Fileman CVE List

Lucene search

RoxyfilemanRoxy Fileman

6 matches found

CVE•added 2022/11/09 7:15 a.m.•86 views

CVE-2022-40797

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

9.8CVSS9.6AI score0.06396EPSS

CVE•added 2019/03/21 4:0 p.m.•60 views

CVE-2018-20525

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

9.1CVSS8.3AI score0.32924EPSS

CVE•added 2019/03/21 4:0 p.m.•60 views

CVE-2018-20526

Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

9.8CVSS9.4AI score0.83406EPSS

CVE•added 2019/12/16 5:15 p.m.•50 views

CVE-2019-19731

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (becau...

7.5CVSS7.8AI score0.25357EPSS

CVE•added 2019/04/09 6:29 p.m.•42 views

CVE-2019-7174

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

9.8CVSS9.4AI score0.00433EPSS

CVE•added 2018/06/07 8:29 p.m.•24 views

CVE-2018-12042

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

7.5CVSS7.5AI score0.00561EPSS