Afian

afian

14 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (14)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-28876 1Afian 1Filerun Jun 17, 2026 Dec 6, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
CVE-2023-28875 1Afian 1Filerun Jun 17, 2026 Dec 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.
CVE-2022-30469 1Afian 1Filerun Jun 17, 2026 Jun 6, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.
CVE-2022-30470 1Afian 1Filerun Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.
CVE-2021-35506 1Afian 1Filerun Jul 5, 2026 Oct 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVE-2021-35505 1Afian 1Filerun Jul 5, 2026 Oct 5, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVE-2021-35504 1Afian 1Filerun Jul 5, 2026 Oct 5, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
CVE-2021-35503 1Afian 1Filerun Jul 5, 2026 Oct 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
CVE-2019-12905 1Afian 1Filerun Jun 17, 2026 Jun 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12459 1Afian 1Filerun Jun 17, 2026 May 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12458 1Afian 1Filerun Jun 17, 2026 May 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2019-12457 1Afian 1Filerun Jun 17, 2026 May 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.
CVE-2018-7735 1Afian 1Filerun Jun 17, 2026 Mar 6, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata&section=cpanel&page=list_filetypes request.
CVE-2018-7734 1Afian 1Filerun Jun 17, 2026 Mar 6, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&section=cpanel&page=list request.