Veille CVE

Recherche « dulldusk phpfm »

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « dulldusk phpfm » ✕
  1. CVE-2026-72593 9.8 Critique

    dulldusk phpfm

    A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

  2. CVE-2026-72592 9.8 Critique

    dulldusk phpfm

    An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.