CVE-2021-47899 | Medium | 4.0 | 2026-01-23 | YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote fi… |
CVE-2019-20062 | Critical | 9.8 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used). |
CVE-2019-20061 | High | 7.5 | 2020-02-10 | The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other wor… |
CVE-2019-20060 | High | 7.5 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset has… |
CVE-2019-20059 | High | 8.8 | 2020-02-10 | payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQ… |
CVE-2019-19806 | Medium | 5.3 | 2019-12-30 | _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the accou… |
CVE-2019-19805 | Medium | 5.3 | 2019-12-30 | _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address i… |
CVE-2019-19739 | High | 7.5 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels. |
CVE-2019-19738 | Medium | 6.1 | 2019-12-30 | log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow a… |
CVE-2019-19737 | High | 8.8 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentiall… |
CVE-2019-19736 | Medium | 6.1 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be u… |
CVE-2019-19735 | Critical | 9.1 | 2019-12-30 | class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows… |
CVE-2019-19734 | High | 8.8 | 2019-12-30 | _account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacke… |
CVE-2019-19733 | Medium | 6.1 | 2019-12-30 | _get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output… |
CVE-2019-19732 | High | 7.2 | 2019-12-30 | translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir_0 and/or sSo… |