Afian

14 CVEs across 1 Afian products. Browse Afian vulnerabilities, severities, and proof-of-concept exploits.

Afian products with known CVEs

ProductCVEs
Filerun14
Afian CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2023-28876Medium4.32023-12-06A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other u…
CVE-2023-28875Medium5.42023-12-06A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows th…
CVE-2022-30469High8.82022-06-06In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.
CVE-2022-30470Critical9.82022-06-02In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the conte…
CVE-2021-35506Medium6.12021-10-05Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVE-2021-35505High7.22021-10-05Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVE-2021-35504High7.22021-10-05Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
CVE-2021-35503Medium6.12021-10-05Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
CVE-2019-12905Medium6.12019-06-20FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12459Medium5.32019-05-30FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12458Medium5.32019-05-30FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12457Medium5.32019-05-30FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2018-7735High7.22018-03-06Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metada…
CVE-2018-7734High7.22018-03-06Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&…