Eerror311

Products

Exploited and recent CVEs

• CVE-2026-104109 Medium 6.8 FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root 0.4%
• CVE-2026-104107 Medium 6.5 FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs 0.4%
• CVE-2026-104110 Medium 5.3 FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php 0.3%
• CVE-2026-104108 High 8.1 FileRise OIDC login can bind an attacker identity to an existing local account 0.2%
• CVE-2026-103977 High 8.1 FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts 0.4%
• CVE-2026-104105 Medium 6.4 FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) 0.3%
• CVE-2026-104106 Medium 6.5 FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification 0.3%
• CVE-2026-103988 Medium 5.4 FileRise renameFolder omits destination-parent authorization 0.2%
• CVE-2026-69193 Medium 6.5 FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying 0.4%
• CVE-2026-69191 Medium 5.4 FileRise: Login Method Restriction Bypass via Direct API Access 0.2%
• CVE-2026-77427 Medium 5.9 FileRise: Insecure default cryptographic key fallback in manual installs 0.3%
• CVE-2026-69194 Medium 4.8 FileRise: Unsanitized footerHtml in Public Site Config 0.2%
• CVE-2026-64856 Low 3.7 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint 0.2%
• CVE-2026-62664 Medium 5.4 FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root 0.3%
• CVE-2026-61844 High 7.1 FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation 0.3%
• CVE-2026-61843 High 8.2 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares 0.4%
• CVE-2026-57493 Medium 6.8 FileRise: Remember-me auto-login uses stale admin role from token instead of current role 0.3%
• CVE-2026-57492 High 7.4 FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation 0.3%
• CVE-2026-57490 High 8.1 FileRise: WebDAV authentication bypasses TOTP/MFA entirely 0.5%
• CVE-2026-57491 Medium 6.5 FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist 0.3%
• CVE-2026-57489 High 8.1 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass 0.6%
• CVE-2026-55498 Medium 4.8 FileRise Shared Folder Symlink Escape 0.3%
• CVE-2026-54459 Medium 4.3 FileRise: Missing CSRF enforcement for file creation and share-link creation 0.1%
• CVE-2026-92616 Medium 6.8 FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance 0.4%
• CVE-2026-54414 Critical 9.8 FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover 0.7%
• CVE-2026-44460 High 7.4 FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret 0.3%
• CVE-2026-33477 Medium 4.3 FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content 0.2%
• CVE-2026-33330 High 7.1 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback 0.4%
• CVE-2026-33329 High 8.1 FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle 0.5%
• CVE-2026-33072 High 8.2 FileRise: Default Encryption Key Enables Token Forgery and Config Decryption 0.2%