GCVE - cpe:2.3:a:vastsa:filecodebox:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vastsa:filecodebox:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-64619`	vulnerable	2026-07-29 01:06:19.786879	FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers HIGH (7.5) FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication. Published: 2026-07-20T18:50:12.359Z Updated: 2026-07-28T01:05:55.926Z Open on db.gcve.eu Reference links https://github.com/vastsa/FileCodeBox/issues/479 https://github.com/vastsa/FileCodeBox/releases/tag/V2.4 https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da https://www.vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-34525`	vulnerable	2026-06-08 06:37:33.428237	Details available FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. Published: 2024-05-05T00:00:00.000Z Updated: 2024-08-02T02:59:20.776Z Open on db.gcve.eu Reference links https://github.com/vastsa/FileCodeBox/issues/133	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.