Vendors / Afian Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 5
Exploited now Afian records in CISA KEV No Afian vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 47
In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0271 · Published 2022-06-01 · No fix listed
Priority MEDIUM 41
In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01458 · Published 2022-06-06 · No fix listed CWE-89
Priority LOW 37
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02843 · Published 2021-10-05 · No fix listed CWE-74
Priority LOW 37
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.03181 · Published 2021-10-05 · No fix listed CWE-74
Priority LOW 34
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman§ion=do&page=up URI.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03605 · Published 2019-06-20 · No fix listed CWE-79
Priority LOW 34
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=list_filetypes request.
CVSS 3.0 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01293 · Published 2018-03-06 · No fix listed CWE-89
Priority LOW 34
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request.
CVSS 3.0 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01293 · Published 2018-03-06 · No fix listed CWE-89
Priority LOW 29
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00742 · Published 2021-10-05 · No fix listed CWE-79
Priority LOW 29
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00742 · Published 2021-10-05 · No fix listed CWE-79
Priority LOW 28
FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01837 · Published 2019-05-30 · No fix listed CWE-22
Priority LOW 28
FileRun 2019.05.21 allows css/ext-ux Directory Listing.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01837 · Published 2019-05-30 · No fix listed CWE-22
Priority LOW 28
FileRun 2019.05.21 allows images/extjs Directory Listing.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01837 · Published 2019-05-30 · No fix listed CWE-22
Priority LOW 25
A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00425 · Published 2023-12-06 · No fix listed CWE-79
Priority LOW 21
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
CVSS 3.1 MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00483 · Published 2023-12-06 · No fix listed
Open these records in search → All records by CVSS severity
1 5 8 0 0
THREATIST.IORead the docs