Vendors / Roxyfileman Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 2
Exploited now Roxyfileman records in CISA KEV No Roxyfileman vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04148 · Published 2022-11-09 · No fix listed CWE-434
Priority HIGH 80
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.73056 · Published 2019-03-18 · No fix listed CWE-434
Priority MEDIUM 59
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.21646 · Published 2019-03-18 · No fix listed CWE-22
Priority MEDIUM 46
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.11617 · Published 2019-12-16 · No fix listed CWE-22
Priority MEDIUM 45
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01656 · Published 2019-04-09 · No fix listed
Priority LOW 36
Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01766 · Published 2018-06-07 · No fix listed CWE-22
Open these records in search → All records by CVSS severity
4 2 0 0 0
THREATIST.IORead the docs