Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

filament — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in filament, with AI-generated Chinese analysis, references, and POCs.

Vendor: filamentphp

CVE ID Title CVSS Severity Published
CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication CWE-306 5.4 Medium 2026-10-01
CVE-2026-84307 Filament: Password validity disclosure for accounts denied panel access on login page CWE-204 3.7 Low 2026-09-01
CVE-2026-84306 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used CWE-294 6.5 Medium 2026-09-01
CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled CWE-287 8.1 High 2026-08-24
CVE-2026-55409 Filament: Disabled RichEditor field state can be used for XSS CWE-79 7.6 High 2026-06-22
CVE-2026-48067 Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields CWE-639 6.5 Medium 2026-06-22
CVE-2026-48167 Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS CWE-79 6.4 Medium 2026-06-22
CVE-2026-48500 Filament: Unauthenticated temporary file upload on auth pages CWE-862 6.5 Medium 2026-06-22
CVE-2026-48166 Filament: Timing-based user enumeration on login page CWE-208 5.3 Medium 2026-06-22
CVE-2026-48505 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CWE-362 7.4 High 2026-06-22
CVE-2026-33080 Filament: Unvalidated Range and Values summarizer values can be used for XSS CWE-79 7.3 High 2026-03-20
CVE-2025-67507 Filament's multi-factor authentication (app) recovery codes can be used multiple times CWE-287 8.1 High 2025-12-10
CVE-2024-51758 Exported files stored in default (`public`) filesystem if not reconfigured in filament CWE-1188 7.1AI High AI 2024-11-07
CVE-2024-47186 Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting CWE-79 6.1 Medium 2024-09-27

All 14 known CVE vulnerabilities affecting filament with full Chinese analysis, references, and POCs where available.