Studio 42 elFinder allows stored XSS

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-45919 · ADVISORY
• trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919 · WEB
• trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919 · Exploit

Autres vulnérabilités de studio-42/elfinder

• CVE-2026-81890MOYENNE 5.4elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted fro…
• CVE-2026-81889ÉLEVÉE 8.6elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinde…
• CVE-2026-44521ÉLEVÉE 8.8elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vuln…
• CVE-2026-41247CRITIQUE 9.8elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injecti…
• CVE-2024-38909CRITIQUE 9.8Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories…