afian vulnerabilities

Products

• filerun 14

Latest afian CVEs

Newest publication first

1. CVE-2023-28875 A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.

   Published 2023-12-06

   Medium·CVSS 5.4 EPSS 0.43%

   A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.

2. CVE-2023-28876 A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.

   Published 2023-12-06

   Medium·CVSS 4.3 EPSS 0.48%

   A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.

3. CVE-2022-30469 In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in /?module=fileman&section=get&page=grid leads to SQL injection.

   Published 2022-06-06

   High·CVSS 8.8 EPSS 1.5%

   In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in /?module=fileman&section=get&page=grid leads to SQL injection.

4. CVE-2022-30470 In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.

   Published 2022-06-01

   Critical·CVSS 9.8 EPSS 2.7%

   In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.

5. CVE-2021-35506 Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.

   Published 2021-10-05

   Medium·CVSS 6.1 EPSS 0.74%

   Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.

6. CVE-2021-35505 Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.

   Published 2021-10-05

   High·CVSS 7.2 EPSS 2.8%

   Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.

7. CVE-2021-35504 Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.

   Published 2021-10-05

   High·CVSS 7.2 EPSS 3.2%

   Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.

8. CVE-2021-35503 Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.

   Published 2021-10-05

   Medium·CVSS 6.1 EPSS 0.74%

   Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.

9. CVE-2019-12905 FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.

   Published 2019-06-20

   Medium·CVSS 6.1 EPSS 3.6%

   FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.

10. CVE-2019-12459 FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.

    Published 2019-05-30

    Medium·CVSS 5.3 EPSS 1.8%

    FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.

11. CVE-2019-12458 FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.

    Published 2019-05-30

    Medium·CVSS 5.3 EPSS 1.8%

    FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.

12. CVE-2019-12457 FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.

    Published 2019-05-30

    Medium·CVSS 5.3 EPSS 1.8%

    FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.

13. CVE-2018-7735 Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata&section=cpanel&page=list_filetypes req...

    Published 2018-03-06

    High·CVSS 7.2 EPSS 1.3%

    Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata&section=cpanel&page=list_filetypes request.

14. CVE-2018-7734 Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&section=cpanel&page=list request.

    Published 2018-03-06

    High·CVSS 7.2 EPSS 1.3%

    Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&section=cpanel&page=list request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.