6.5

CVSS3.1

CVE-2025-26355 -

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 28, 2025, 3:46 p.m.

7.2

CVSS3.1

CVE-2025-26354 -

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 28, 2025, 3:46 p.m.

4.9

CVSS3.1

CVE-2025-26353 -

A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 28, 2025, 3:46 p.m.

6.5

CVSS3.1

CVE-2025-26352 -

A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 28, 2025, 3:46 p.m.

4.9

CVSS3.1

CVE-2025-26351 -

A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 24, 2025, 2:59 p.m.

4.9

CVSS3.1

CVE-2025-26350 -

A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:28 p.m. 🔄 Last Modified: Oct. 24, 2025, 3:01 p.m.

7.2

CVSS3.1

CVE-2025-26349 -

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:27 p.m. 🔄 Last Modified: Oct. 24, 2025, 3:01 p.m.

5.5

CVSS3.1

CVE-2025-26348 -

A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requ…

📅 Published: Feb. 12, 2025, 1:27 p.m. 🔄 Last Modified: Oct. 24, 2025, 3:02 p.m.

9.8

CVSS3.1

CVE-2025-26347 -

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.

📅 Published: Feb. 12, 2025, 1:27 p.m. 🔄 Last Modified: Oct. 24, 2025, 3:03 p.m.

5.5

CVSS3.1

CVE-2025-26346 -

A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP…

📅 Published: Feb. 12, 2025, 1:27 p.m. 🔄 Last Modified: Oct. 24, 2025, 3:03 p.m.
Total resulsts: 344064
Page 6252 of 34,407
« previous page » next page
Filters