CVE-2018-20791

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.exploit-db.com/exploits/45987Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45987Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-207927.5tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the CVE-2018-207937.5tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mi CVE-2018-207947.5tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the CVE-2018-207957.5tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through th CVE-2018-207967.5In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demons CVE-2018-207976.5An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagem CVE-2018-207987.5The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by s CVE-2018-207997.5In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP a CVE-2018-208006.5An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 CVE-2018-208017.5In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a den CVE-2018-208026.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affec CVE-2018-208036.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in