CVE-2019-7174

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-71757.5In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.CVE-2019-71763.7An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 1 CVE-2019-71777.2Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.CVE-2019-71787.2Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.CVE-2019-71817.5Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program.CVE-2019-71839.8This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updati CVE-2019-71844.8This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71854.8This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71929.8This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, CVE-2019-71939.8This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP CVE-2019-71949.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71959.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,