Skip to content

Product

dulldusk phpfilemanager vulnerabilities

3 published CVES affecting dulldusk phpfilemanager, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
1
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest dulldusk phpfilemanager CVEs

Newest publication first

  1. CVE-2019-25632 phpFileManager 1.7.8 Local File Inclusion via index.php

    Published
    MediumCVSS 6.9 EPSS 0.58%

    phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to acce...

  2. CVE-2023-53894 phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability

    Published
    CriticalCVSS 9.3 EPSS 0.62%

    phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP fil...

  3. CVE-2024-5673 Cross-Site Scripting in PHP File Manager by Dulldusk

    Published
    MediumCVSS 6.1 EPSS 0.25%

    Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.