# cve.now: Kalcaddle

The newest entries naming Kalcaddle as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104081](https://cve.now/CVE-2026-104081.md): KodExplorer \< 4.55 Path Traversal via unzip\_pre\_name() ZIP Extraction (CVSS 7.2)
- [CVE-2026-18721](https://cve.now/CVE-2026-18721.md): kalcaddle kodbox SSO API Login apiLogin redirect (CVSS 5.3)
- [CVE-2026-18720](https://cve.now/CVE-2026-18720.md): kalcaddle kodbox msgWarning Plugin action improper authorization (CVSS 6.9)
- [CVE-2026-8753](https://cve.now/CVE-2026-8753.md): kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection (CVSS 5.3)
- [CVE-2026-5618](https://cve.now/CVE-2026-5618.md): kalcaddle kodbox shareMake/shareCheck server-side request forgery (CVSS 6.3)
- [CVE-2026-4831](https://cve.now/CVE-2026-4831.md): kalcaddle kodbox Password-protected Share auth.class.php can improper authentication (CVSS 6.3)
- [CVE-2026-4830](https://cve.now/CVE-2026-4830.md): kalcaddle kodbox Public Share userShare.class.php add privilege escalation (CVSS 6.3)
- [CVE-2026-4592](https://cve.now/CVE-2026-4592.md): kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication (CVSS 6.3)
- [CVE-2026-4591](https://cve.now/CVE-2026-4591.md): kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection (CVSS 5.1)
- [CVE-2026-4590](https://cve.now/CVE-2026-4590.md): kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery (CVSS 2.3)
- [CVE-2026-4589](https://cve.now/CVE-2026-4589.md): kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery (CVSS 5.3)
- [CVE-2026-4588](https://cve.now/CVE-2026-4588.md): kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key (CVSS 6.3)
- [CVE-2026-2560](https://cve.now/CVE-2026-2560.md): kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection (CVSS 5.3)
- [CVE-2026-1066](https://cve.now/CVE-2026-1066.md): kalcaddle kodbox Compression zip command injection (CVSS 5.3)
- [CVE-2025-11016](https://cve.now/CVE-2025-11016.md): kalcaddle kodbox index.class.php fileOut path traversal (CVSS 5.3)
- [CVE-2025-10233](https://cve.now/CVE-2025-10233.md): kalcaddle kodbox editor.class.php fileSave path traversal (CVSS 5.3)
- [CVE-2025-9414](https://cve.now/CVE-2025-9414.md): kalcaddle kodbox Download from Link serverDownload server-side request forgery (CVSS 5.1)
- [CVE-2023-6853](https://cve.now/CVE-2023-6853.md): kalcaddle KodExplorer app.php index server-side request forgery (CVSS 6.3)
- [CVE-2023-6852](https://cve.now/CVE-2023-6852.md): kalcaddle KodExplorer app.php server-side request forgery (CVSS 6.3)
- [CVE-2023-6851](https://cve.now/CVE-2023-6851.md): kalcaddle KodExplorer ZIP Archive app.php unzipList code injection (CVSS 6.3)
- [CVE-2023-6850](https://cve.now/CVE-2023-6850.md): kalcaddle KodExplorer API Endpoint unrestricted upload (CVSS 6.3)
- [CVE-2023-6849](https://cve.now/CVE-2023-6849.md): kalcaddle kodbox app.php cover server-side request forgery (CVSS 7.3)
- [CVE-2023-6848](https://cve.now/CVE-2023-6848.md): kalcaddle kodbox index.class.php check command injection (CVSS 7.3)
- [CVE-2022-4944](https://cve.now/CVE-2022-4944.md): kalcaddle KodExplorer cross-site request forgery (CVSS 4.3)
- [CVE-2022-46154](https://cve.now/CVE-2022-46154.md): Arbitrary file access in KodExplorer (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kalcaddle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.