File Management System
Monthly
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
Unauthenticated remote attackers can invoke the index, store, update, and destroy actions of the Files API in MomoTommy file-management-system (app/Http/Controllers/FileController.php) because those actions lack any authentication check, allowing unauthorized listing, upload, modification, and deletion of files. The project is unversioned and has not responded to the early issue report, and publicly available exploit code exists (CWE-306, CVSS 4.0 score 5.5), though the niche hobby-project footprint and low confidentiality, integrity, and availability impact keep this a genuine but modest-priority issue rather than a top-tier emergency.
A security flaw has been discovered in itsourcecode Online File Management System 1.0.php?action=login. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
Unauthenticated remote attackers can invoke the index, store, update, and destroy actions of the Files API in MomoTommy file-management-system (app/Http/Controllers/FileController.php) because those actions lack any authentication check, allowing unauthorized listing, upload, modification, and deletion of files. The project is unversioned and has not responded to the early issue report, and publicly available exploit code exists (CWE-306, CVSS 4.0 score 5.5), though the niche hobby-project footprint and low confidentiality, integrity, and availability impact keep this a genuine but modest-priority issue rather than a top-tier emergency.
A security flaw has been discovered in itsourcecode Online File Management System 1.0.php?action=login. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.