ed

7 exploits Active since Feb 2019
CVE-2019-5782 NOMISEC HIGH WORKING POC
Google Chrome < 72.0.3626.81 - Out-of-Bounds Write
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
22 stars
CVSS 8.8
CVE-2026-30974 WRITEUP MEDIUM WRITEUP
Copyparty <1.20.11 - XSS
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
CVSS 4.6
CVE-2026-27948 WRITEUP MEDIUM WRITEUP
Copyparty <1.20.9 - XSS
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.
CVSS 5.4
CVE-2025-27145 WRITEUP LOW WRITEUP
copyparty <1.16.15 - XSS
copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally possible to upload HTML-files with arbitrary javascript in `<script>` tags, which will execute when the file is opened. The difference is that this vulnerability would trigger execution of javascript during the act of uploading, and not when the uploaded file was opened. Version 1.16.15 contains a fix.
CVSS 3.6
CVE-2025-54423 WRITEUP MEDIUM WRITEUP
9001 Copyparty < 1.18.5 - XSS
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.
CVSS 5.4
CVE-2025-54796 WRITEUP HIGH WRITEUP
Copyparty <1.18.9 - DoS
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
CVSS 7.5
CVE-2025-58753 WRITEUP HIGH WRITEUP
Copyparty <1.19.8 - Info Disclosure
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.
CVSS 7.5