Approved changes feed: RSS · Atom
cpe:2.3:a:pydio:pydio:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pydio (08ebd1f1-c9a4-5b4e-9bb7-6e1d89420153) |
|---|---|
| Product | Pydio (3a9bf5bb-5b57-5a83-b676-3101f3bf3ec9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pydio/pydio-core |
purl2cpe | 2026-06-01 10:14:39.760683 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-40124 |
vulnerable | 2026-06-08 06:43:52.147940 |
Details available
Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.
Published: 2025-04-17T00:00:00.000Z
Updated: 2025-04-18T15:09:19.107Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9642 |
vulnerable | 2026-06-08 05:14:25.907792 |
Details available
An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a proxy.php?hash=../../../../../var/lib/pydio/data/personal/guest/PoC.php request. This is related to plugins/action.share/src/Store/ShareStore.php.
Published: 2019-06-05T16:15:04.000Z
Updated: 2024-08-04T21:54:45.127Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20453 |
vulnerable | 2026-06-08 05:13:40.643351 |
Details available
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
Published: 2020-03-17T13:56:58.000Z
Updated: 2024-08-05T02:39:09.929Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20452 |
vulnerable | 2026-06-08 05:13:40.642267 |
Details available
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
Published: 2020-03-17T13:56:00.000Z
Updated: 2024-08-05T02:39:10.136Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10049 |
vulnerable | 2026-06-08 05:12:21.950944 |
Details available
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code (that is executed in the context of the victim user to obtain sensitive information such as session identifiers and perform actions on behalf of him/her).
Published: 2019-05-31T21:17:46.000Z
Updated: 2024-08-04T22:10:09.306Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10048 |
vulnerable | 2026-06-08 05:12:21.950542 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10047 |
vulnerable | 2026-06-08 05:12:21.950110 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10045 |
vulnerable | 2026-06-08 05:12:21.942600 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20718 |
vulnerable | 2026-06-08 05:11:27.777369 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1999018 |
vulnerable | 2026-06-08 05:11:15.095221 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1999017 |
vulnerable | 2026-06-08 05:11:15.094888 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1999016 |
vulnerable | 2026-06-08 05:11:15.094354 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-14772 |
vulnerable | 2026-06-08 05:10:53.433217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3432 |
vulnerable | 2026-06-08 05:06:38.288347 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3431 |
vulnerable | 2026-06-08 05:06:38.287948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-6227 |
vulnerable | 2026-06-08 05:04:55.693286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-4267 |
vulnerable | 2026-06-08 05:04:34.991767 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.