CVE-2023-52082

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...

GHSA-C86P-W88R-QVQR vulnerabilities

Vulnerabilities for packages: sccache, samply, ntpd-rs, sqlx, xh, oranda, wash, lychee, cargo-audit, kdash, buck2, wasmtime, rye, zola...

CVE-2025-4432 vulnerabilities

Vulnerabilities for packages: wasmcloud, samply, uv, oranda, zizmor, lychee, kdash, qdrant, deno, sccache, tealdeer, parseable, sqlx, nushell, zed, zola, shadowsocks-rust, wash, sdp-k8s-injector, cargo-audit, wadm, rye, pixi, linkerd2-proxy, wasm-pack, atuin, ntpd-rs, rustup, xh, rustls-ffi,...

GHSA-4P46-PWFR-66X6 vulnerabilities

Vulnerabilities for packages: rustls-ffi, zizmor, linkerd-extension-init, tealdeer, samply, nushell, wadm, sqlx, wash, parseable, ntpd-rs, xh, buck2, wasmtime, kdash, rye, rustup, zola, uv, sccache, zed, wasm-pack, shadowsocks-rust, wasmcloud, sdp-k8s-injector, qdrant, pixi, lychee, fnm, atuin,...

CVE-2025-24898 vulnerabilities

Vulnerabilities for packages: sccache, rustup, linkerd2, nushell, berg, lychee, linkerd-extension-init, sdp-k8s-injector, zed...

GHSA-RPMJ-RPGJ-QMPM vulnerabilities

Vulnerabilities for packages: rustup, berg, nushell, sdp-k8s-injector, linkerd2, linkerd-extension-init, lychee, sccache, zed...

GHSA-RPMJ-RPGJ-QMPM vulnerabilities

Vulnerabilities for packages: sccache, rustup, linkerd2, nushell, berg, lychee, linkerd-extension-init, sdp-k8s-injector, zed...

GHSA-Q445-7M23-QRMW vulnerabilities

Vulnerabilities for packages: rustup, berg, sdp-k8s-injector, pixi, lychee, sccache, zed...

CVE-2024-25808

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...

CVE-2024-25808

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...

CVE-2024-25807

Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...

Lychee security vulnerabilities

Lychee is a beautiful and easy to use photo management system from The Lychee Organisation open source. It is used to manage and share photos. A security vulnerability exists in Lychee version 3.1.6, which stems from a cross-site request forgery CSRF vulnerability. The vulnerability can be...

Lychee security vulnerabilities

Lychee is a beautiful and easy to use photo management system from The Lychee Organisation open source. It is used to manage and share photos. A security vulnerability exists in Lychee version 3.1.6, which stems from a cross-site scripting XSS vulnerability. The vulnerability can be exploited by ...

CVE-2024-25808

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...

CVE-2024-25807

Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...

CVE-2024-25808: Cross-Site Request Forgery (CSRF)

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...

CVE-2024-25807: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...

CVE-2024-25807

Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...

CVE-2024-25808

Cross-site Request Forgery CSRF vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function...