Dulldusk vulnerabilities
5 vulnerabilities
Known vulnerabilities in Dulldusk products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Phpfilemanager3 vulnerabilities
- Phpfm3 vulnerabilities
- PHP File Manager1 vulnerabilities
CVE-2024-5673dullduskphp file manager+1
EPSS score0.25%
Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.CVE-2019-25632dullduskphpfilemanager+1EPSS score0.57%
phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.CVE-2026-72592dullduskphpfmEPSS score0.80%
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.CVE-2026-72593dullduskphpfmEPSS score0.79%
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.CVE-2023-53894dullduskphpfilemanager+1EPSS score0.62%
phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.