SpeWnz/Vulnerability-Research

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-30578 ↗	Mar 20, 2026Friday, 20 March 2026, 18:16	6.5 MEDIUM	—
File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javascript code.
CVE-2026-30579 ↗	Mar 20, 2026Friday, 20 March 2026, 18:16	6.5 MEDIUM	—
File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted file name used to trigger a Javascript payload.
CVE-2026-30580 ↗	Mar 20, 2026Friday, 20 March 2026, 18:16	4.3 MEDIUM	—
File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system.