9001 Copyparty

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.

Path traversal in copyparty

Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

copyparty: Sharing a single file does not fully restrict access to other files in source folder

Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

copyparty vulnerable to reflected cross-site scripting via k304 parameter

copyparty Reflected XSS via Filter Parameter

copyparty renders unsanitized filenames as HTML when user uploads empty files

copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata

Copyparty vulnerable to eflected cross-site scripting via setck parameter

Copyparty volflag `nohtml` did not block javascript in svg files

Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`