Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pydio pydio vulnerabilities and exploits
(subscribe to this query)
5.4
CVSSv3
CVE-2019-10047
A stored XSS vulnerability exists in the web application of Pydio up to and including 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards ...
Pydio Pydio
4.9
CVSSv3
CVE-2018-1999017
Pydio version 8.2.0 and previous versions contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests th...
Pydio Pydio
6.6
CVSSv3
CVE-2018-1999018
Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrar...
Pydio Pydio
9.8
CVSSv3
CVE-2019-9642
An issue exists in proxy.php in pydio-core in Pydio up to and including 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution...
Pydio Pydio
6.1
CVSSv3
CVE-2018-1999016
Pydio version 8.2.0 and previous versions contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated ...
Pydio Pydio
9.8
CVSSv3
CVE-2018-20718
In Pydio prior to 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of su...
Pydio Pydio
1 Github repository
7.2
CVSSv3
CVE-2018-14772
Pydio 4.2.1 up to and including 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web application can execute arbitrary code on the underlying system via Command Injection.
Pydio Pydio
9.8
CVSSv3
CVE-2015-3431
Pydio (formerly AjaXplorer) prior to 6.0.7 allows remote malicious users to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Pydio Pydio
6.1
CVSSv3
CVE-2015-3432
Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) prior to 6.0.7 allow remote malicious users to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."
Pydio Pydio
8.8
CVSSv3
CVE-2019-20453
A problem was found in Pydio Core prior to 8.2.4 and Pydio Enterprise prior to 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
Pydio Pydio
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
IMAP
CVE-2024-36103
CVE-2024-28995
CVE-2024-37325
CVE-2024-30078
CVE-2024-30082
SQL injection
CVE-2024-30052
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »