Afian: Security Vulnerabilities
A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.
CVSS Score
5.4
EPSS Score
0.001
Published
2023-12-06
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
CVSS Score
4.3
EPSS Score
0.001
Published
2023-12-06
In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection.
CVSS Score
8.8
EPSS Score
0.012
Published
2022-06-06
In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.
CVSS Score
9.8
EPSS Score
0.083
Published
2022-06-02
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-10-05
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-10-05
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
CVSS Score
7.2
EPSS Score
0.095
Published
2021-10-05
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVSS Score
7.2
EPSS Score
0.032
Published
2021-10-05
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman§ion=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.
CVSS Score
6.1
EPSS Score
0.037
Published
2019-06-20
FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVSS Score
5.3
EPSS Score
0.004
Published
2019-05-30
Page 1