roxyfileman vulnerabilities

Products

• roxy fileman 5

Latest roxyfileman CVEs

Newest publication first

1. CVE-2019-19731 Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by up...

   Published 2019-12-16

   High·CVSS 7.5 EPSS 11.6%

   Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the St...

2. CVE-2019-7174 Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

   Published 2019-04-09

   Critical·CVSS 9.8

   Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

3. CVE-2018-20525 Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

   Published 2019-03-21

   Critical·CVSS 9.1 EPSS 21.6%

   Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

4. CVE-2018-20526 Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

   Published 2019-03-21

   Critical·CVSS 9.8 EPSS 73.1%

   Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

5. CVE-2018-12042 Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

   Published 2018-06-07

   High·CVSS 7.5

   Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.