LiquidFiles records

8 published records for vendor liquidfiles.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 12.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2021-43397No exploit	LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.liquidfiles · liquidfiles · CWE-522 Info leak	High8.8	—	3.8%	Nov 11, 2021
36Monitor	CVE-2020-29071No exploit	An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19.liquidfiles · liquidfiles · CWE-79 XSS	Critical9.0	—	1.7%	Nov 24, 2020
35Monitor	CVE-2025-46093No exploit	LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as liquidfiles · liquidfiles · CWE-732 RCE	High8.8	—	0.5%	Aug 4, 2025
29Monitor	CVE-2025-56132Proof of concept	LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.liquidfiles · liquidfiles · CWE-305 Pre-auth Auth bypass	High7.3	—	0.7%	Sep 30, 2025
24Monitor	CVE-2020-29072No exploit	A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19.liquidfiles · liquidfiles · CWE-829 Pre-auth	Medium6.1	—	0.7%	Nov 24, 2020
24Monitor	CVE-2023-4393No exploit	HTML and SMTP Injection in LiquidFilesliquidfiles · liquidfiles · CWE-116 Pre-auth	Medium6.1	—	0.3%	Oct 29, 2023
21Monitor	CVE-2021-30140No exploit	LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator.liquidfiles · liquidfiles · CWE-79 XSS	Medium5.4	—	1.4%	Apr 6, 2021
15Monitor	CVE-2025-46094No exploit	LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.liquidfiles · liquidfiles · CWE-24 Path traversal	Low3.8	—	0.5%	Aug 4, 2025

CVE-2021-43397
36Monitor
LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
HighCVSS 8.8No exploitEPSS 4%
- Info leak
liquidfiles · liquidfilesNov 11, 2021
CVE-2020-29071
36Monitor
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19.
CriticalCVSS 9.0No exploitEPSS 2%
- XSS
liquidfiles · liquidfilesNov 24, 2020
CVE-2025-46093
35Monitor
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as
HighCVSS 8.8No exploitEPSS 1%
- RCE
liquidfiles · liquidfilesAug 4, 2025
CVE-2025-56132
29Monitor
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.
HighCVSS 7.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
liquidfiles · liquidfilesSep 30, 2025
CVE-2020-29072
24Monitor
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
liquidfiles · liquidfilesNov 24, 2020
CVE-2023-4393
24Monitor
HTML and SMTP Injection in LiquidFiles
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
liquidfiles · liquidfilesOct 29, 2023
CVE-2021-30140
21Monitor
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
liquidfiles · liquidfilesApr 6, 2021
CVE-2025-46094
15Monitor
LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.
LowCVSS 3.8No exploitEPSS 1%
- Path traversal
liquidfiles · liquidfilesAug 4, 2025