zakumini/CVE-List

Releases0

A public list of CVEs I have discovered and responsibly disclosed.

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-46000NVD↗	—	Jul 18, 2025Friday, 18 July 2025, 15:15	6.5 MEDIUM	—
An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVE-2025-46001NVD↗	—	Jul 18, 2025Friday, 18 July 2025, 14:15	9.8 CRITICAL	—
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2025-46002NVD↗	—	Jul 18, 2025Friday, 18 July 2025, 14:15	6.5 MEDIUM	—
An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.