Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: xbtitfm Clear all filters
TI-2024-38410 CVE-2024-58313 · GHSA-7v2x-vj66-5pgm

xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature

Priority HIGH 72

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0061 Published 2025-12-11 No fix listed CWE-434
TI-2024-38409 CVE-2024-58312 · GHSA-q566-6fqg-9j2h

xbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php

Priority HIGH 73

xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01203 Published 2025-12-11 No fix listed CWE-22
TI-2024-38406 CVE-2024-58309 · GHSA-36pw-gpfg-hfxr

xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php

Priority HIGH 73

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00579 Published 2025-12-11 No fix listed CWE-89