Mfscripts - vulnerabilities (CVEs)
15 CVEs in 2 products, 0 in the last 30 days, newest from 2026-01-23.
Products
- Yetishare - 15 CVEs
- Yetishare File Hosting Script - 0 CVEs
Newest CVEs of Mfscripts
- CVE-2021-47899 - CVSS 6.9 (medium), 2026-01-23: YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote…
- CVE-2019-20062 - CVSS 9.8 (critical), 2020-02-10: MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).
- CVE-2019-20059 - CVSS 8.8 (high), 2020-02-10: payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a…
- CVE-2019-20061 - CVSS 7.5 (high), 2020-02-10: The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other…
- CVE-2019-20060 - CVSS 7.5 (high), 2020-02-10: MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset…
- CVE-2019-19806 - CVSS 5.3 (medium), 2019-12-30: _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the…
- CVE-2019-19805 - CVSS 5.3 (medium), 2019-12-30: _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address…
- CVE-2019-19735 - CVSS 9.1 (critical), 2019-12-30: class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which…
- CVE-2019-19738 - CVSS 6.1 (medium), 2019-12-30: log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow…
- CVE-2019-19734 - CVSS 8.8 (high), 2019-12-30: _account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an…
- CVE-2019-19737 - CVSS 8.8 (high), 2019-12-30: MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and…
- CVE-2019-19736 - CVSS 6.1 (medium), 2019-12-30: MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be…
- CVE-2019-19739 - CVSS 7.5 (high), 2019-12-30: MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels.
- CVE-2019-19732 - CVSS 7.2 (high), 2019-12-30: translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir_0 and/or…
- CVE-2019-19733 - CVSS 6.1 (medium), 2019-12-30: _get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output…
