Approved changes feed: RSS · Atom
cpe:2.3:a:humhub:cfiles:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Humhub (207df78f-b45f-5aa6-92d9-43f6e5adcae3) |
|---|---|
| Product | Cfiles (554e4804-5b6c-5967-b3e4-570d07910ec5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-65963 |
vulnerable | 2026-06-08 07:39:21.104102 |
CFiles Unauthorized Folder/ZIP Access in Public Spaces
MEDIUM (5.4)
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
Published: 2025-11-25T23:38:49.198Z
Updated: 2025-11-26T16:13:16.288Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54790 |
vulnerable | 2026-06-08 07:33:13.218368 |
Files: Potential for SQL Injection through File Browse and List Operations
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
Published: 2025-08-01T23:37:23.353Z
Updated: 2025-08-04T15:22:29.986Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54789 |
vulnerable | 2026-06-08 07:33:13.216315 |
Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
Published: 2025-08-01T23:26:32.195Z
Updated: 2025-08-04T15:40:11.383Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.