deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40734
Published: 2025-06-30
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-daily-expense-manager
CVE: CVE-2025-53415
Published: 2025-06-30
Description: Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00009_DTM%20Soft%20and%20DTN%20Soft%20BIN%20File%20Parsing%20Deserialization%20of%20Untrusted%20Data.pdf
CVE: CVE-2025-6899
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file msp_info.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link_DI/CJ_IN_DLink_4_en.pdf; https://vuldb.com/?ctiid.314391; https://vuldb.com/?id.314391
CVE: CVE-2025-6900
Published: 2025-06-30
Description: A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/W2-l0mechan1c/CVE1/issues/1; https://vuldb.com/?ctiid.314392
CVE: CVE-2024-8419
Published: 2025-06-30
Description: The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2024-061
CVE: CVE-2025-41439
Published: 2025-06-30
Description: A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN24333956/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000008
CVE: CVE-2025-53416
Published: 2025-06-30
Description: Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2025-6901
Published: 2025-06-30
Description: A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/removeUser.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/p1nkshox/cve/issues/2; https://vuldb.com/?ctiid.314393
CVE: CVE-2025-6902
Published: 2025-06-30
Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /php_action/editUser.php. The manipulation of the argument edituserName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/p1nkshox/cve/issues/1; https://vuldb.com/?ctiid.314394
CVE: CVE-2025-40710
Published: 2025-06-30
Description: Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause the VPN client to redirect or forward HTTP requests to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic to infrastructure controlled by an attacker. This does not imply a flaw in the target applications, but in how the VPN client internally handles outgoing headers and requests.
CWE: CWE-74
References: https://www.incibe.es/en/incibe-cert/notices/aviso/host-header-injection-hhi-hotspot-shield-vpn-client
CVE: CVE-2025-6903
Published: 2025-06-30
Description: A vulnerability was found in code-projects Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/MaxedFF/cve/issues/1; https://vuldb.com/?ctiid.314395
CVE: CVE-2025-6904
Published: 2025-06-30
Description: A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_cars.php. The manipulation of the argument car_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/MaxedFF/cve/issues/2; https://vuldb.com/?ctiid.314396
CVE: CVE-2025-4407
Published: 2025-06-30
Description: Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-613
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A2771&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2025-6905
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, has been found in code-projects Car Rental System 1.0. This issue affects some unknown processing of the file /signup.php. The manipulation of the argument fname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/15; https://vuldb.com/?ctiid.314399
CVE: CVE-2025-6906
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in code-projects Car Rental System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/14; https://vuldb.com/?ctiid.314397
CVE: CVE-2025-6907
Published: 2025-06-30
Description: A vulnerability classified as critical was found in code-projects Car Rental System 1.0. This vulnerability affects unknown code of the file /book_car.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/13; https://vuldb.com/?ctiid.314398
CVE: CVE-2025-6908
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/91; https://phpgurukul.com/; https://vuldb.com/?ctiid.314400
CVE: CVE-2025-6909
Published: 2025-06-30
Description: A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/92; https://phpgurukul.com/; https://vuldb.com/?ctiid.314401
CVE: CVE-2025-6910
Published: 2025-06-30
Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/93; https://phpgurukul.com/; https://vuldb.com/?ctiid.314403
CVE: CVE-2023-47310
Published: 2025-06-30
Description: A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1174
References: http://mikrotik.com; http://routeros.com; https://forum.mikrotik.com/t/fixed-in-7-14-security-vulnerability-default-configuration-firewall-bypass-for-ipv6-udp/262186
CVE: CVE-2024-53621
Published: 2025-06-30
Description: A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://drive.google.com/file/d/1b7DlkG7XVmJmCxDrX7u1X7CAk-lOviBX/view?usp=sharing; https://github.com/qingwei4/Router-VR/blob/main/CVE-2024-53621/CVE-2024-53621.md
CVE: CVE-2025-2895
Published: 2025-06-30
Description: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7237164
CVE: CVE-2025-6911
Published: 2025-06-30
Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/94; https://phpgurukul.com/; https://vuldb.com/?ctiid.314404
CVE: CVE-2025-6912
Published: 2025-06-30
Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manage-students.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/95; https://phpgurukul.com/; https://vuldb.com/?ctiid.314405
CVE: CVE-2024-12915
Published: 2025-06-30
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS.This issue affects Library Software: before 24.11.02.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0144
CVE: CVE-2025-53001
Published: 2025-06-30
Description: Rejected reason: Reason: This candidate was issued in error.
CVE: CVE-2025-53017
Published: 2025-06-30
Description: Rejected reason: Reason: This candidate was issued in error.
CVE: CVE-2025-6913
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/96; https://phpgurukul.com/; https://vuldb.com/?ctiid.314406
CVE: CVE-2025-6914
Published: 2025-06-30
Description: A vulnerability classified as critical was found in PHPGurukul Student Record System 3.2. Affected by this vulnerability is an unknown functionality of the file /edit-student.php. The manipulation of the argument fmarks2 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/97; https://phpgurukul.com/; https://vuldb.com/?ctiid.314407
CVE: CVE-2025-26074
Published: 2025-06-30
Description: Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/conductor-oss/conductor; https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java; https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb
CVE: CVE-2025-45143
Published: 2025-06-30
Description: string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1333
References: https://gist.github.com/6en6ar/361608bccedb[PII_REDACTED]81fe2f1b39; https://github.com/devrafalko/string-math/blob/master/string-math.js; https://www.npmjs.com/package/string-math%2C
CVE: CVE-2025-45931
Published: 2025-06-30
Description: An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://d-link.com; http://dir-816-a2.com; https://github.com/Synmac05/CVE-advisories/blob/main/CVE-2025-45931.md
CVE: CVE-2025-46702
Published: 2025-06-30
Description: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants feature, even when the 'Manage Members' permission has been explicitly removed. This can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-47871
Published: 2025-06-30
Description: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-52895
Published: 2025-06-30
Description: Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/frappe/frappe/commit/c795e351be[PII_REDACTED]37324d74f44759a744a6; https://github.com/frappe/frappe/commit/f[PII_REDACTED]c80c6393647dd0403d399e64c951c; https://github.com/frappe/frappe/pull/31526
CVE: CVE-2025-52896
Published: 2025-06-30
Description: Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/frappe/frappe/commit/152fd09de5bca16b8d299d715a1f5df6fca3866f; https://github.com/frappe/frappe/commit/f11c53d4df745b58bd1c1c08e1634a2f5a55322a; https://github.com/frappe/frappe/pull/31483
CVE: CVE-2025-6915
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Student Record System 3.2. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument session leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/98; https://phpgurukul.com/; https://vuldb.com/?ctiid.314408
CVE: CVE-2025-6916
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-306
References: https://github.com/c0nyy/IoT_vuln/blob/main/TOTOLINK%20T6%20Vuln.md; https://vuldb.com/?ctiid.314409; https://vuldb.com/?id.314409
CVE: CVE-2025-52898
Published: 2025-06-30
Description: Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://github.com/frappe/frappe/commit/52e31337a6c964189c8b883a2f7bc3a28ab374f2; https://github.com/frappe/frappe/commit/5b4849b1ab5fd796b306312745b4e202b0e90d66; https://github.com/frappe/frappe/pull/31522
CVE: CVE-2025-6917
Published: 2025-06-30
Description: A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/registration.php. The manipulation of the argument uname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/MaxedFF/cve/issues/4; https://vuldb.com/?ctiid.314410
CVE: CVE-2025-6925
Published: 2025-06-30
Description: A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md; https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md#steps-to-reproduce; https://vuldb.com/?ctiid.314437
CVE: CVE-2025-36593
Published: 2025-06-30
Description: Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol.  An attacker with local network access could potentially exploit this vulnerability to forge a valid protocol accept message in response to a failed authentication request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://www.dell.com/support/kbdoc/en-us/000337238/dsa-2025-257-security-update-for-dell-openmanage-network-integration-omni-vulnerabilities
CVE: CVE-2025-49493
Published: 2025-06-30
Description: Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-611
References: https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes/; https://www.akamai.com/products/cloudtest; https://github.com/SystemVll/CVE-2025-49493
CVE: CVE-2025-52491
Published: 2025-06-30
Description: Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://techdocs.akamai.com/cloudtest/changelog/june-9-2025-enhancements-and-bug-fixes; https://www.akamai.com/products/cloudtest
CVE: CVE-2025-52901
Published: 2025-06-30
Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-598
References: https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2; https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9; https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x
CVE: CVE-2025-52995
Published: 2025-06-30
Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108; https://github.com/filebrowser/filebrowser/releases/tag/v2.33.10; https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w7qc-6grj-w7r8