Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Roxyfileman

First CVE: Jun 7, 2018Active for: 8 yearsTotal CVEs: 6

Roxyfileman is a file-management component that appears in web applications and content systems, where its disclosures center on a narrow but security-sensitive product scope. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, driven by recurrent weakness classes including path traversal, unrestricted dangerous-file upload, and related input-handling flaws that grant attackers direct access to server filesystems and application data. Defenders should treat updates to this component as high-priority, especially in internet-facing contexts; live severity and exploitation counts are shown alongside this summary.

FAUCET AI Generated
6
Total CVEs
More Total CVEs than 86% of tracked vendors
2.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 80% of tracked vendors
8.9
Avg CVSS Score
Higher Avg CVSS Score than 87% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Roxyfileman over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jun 7, 2018
8 years ago
Most Recent CVE
Nov 9, 2022
1,353 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (6 CVEs).

6 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2018-20526CRITICAL
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
Mar 21, 20199.884NOYES
CVE-2018-20525CRITICAL
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
Mar 21, 20199.152NOYES
CVE-2019-19731HIGH
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for
Dec 16, 20197.537NOYES
CVE-2022-40797CRITICAL
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any
Nov 9, 20229.832NONO
CVE-2019-7174CRITICAL
Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Mov
Apr 9, 20199.831NONO
CVE-2018-12042HIGH
Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.
Jun 7, 20187.523NONO
View all 6 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products6 CVEs
33%
67%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network6 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None6 (100.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (6 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
16.7% of CVEs· 97th percentile
ExploitDB
3 CVEs
50.0% of CVEs· 81st percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Roxyfileman.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Roxyfileman — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Roxyfileman's Products

View all 1 CNAs →

Top CWEs