Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Dulldusk Clear all filters
TI-2026-50850 CVE-2026-72593 · GHSA-pp5f-3rgg-523r

dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

Priority MEDIUM 50

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files any…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0079 Published 2026-08-10 No fix listed CWE-306
TI-2019-15685 CVE-2019-25632 · GHSA-w9gq-m6jq-ff6m

phpFileManager 1.7.8 Local File Inclusion via index.php

Priority MEDIUM 64

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00566 Published 2026-03-24 No fix listed CWE-306
TI-2023-30177 CVE-2023-53894 · GHSA-754q-9vhg-63g7

phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability

Priority MEDIUM 49

phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00622 Published 2025-12-16 No fix listed CWE-1390