CVE-2025-7487

The CVE-2025-7487 entry concerns JoeyBling SpringBoot_MyBatisPlus, specifically the SysFileController in /file/upload. The vulnerability arises from improper handling of the portraitFile argument, enabling unrestricted file uploads and remote exploitation. Public disclosures exist, but the exact ...

CVE-2025-7487 JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted upload

A vulnerability, which was classified as critical, was found in JoeyBling SpringBootMyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is...

CVE-2025-7487 JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted upload

A vulnerability, which was classified as critical, was found in JoeyBling SpringBootMyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is...

PT-2025-29343 · Unknown · Joeybling Springboot Mybatisplus

Name of the Vulnerable Software and Affected Versions: JoeyBling SpringBoot MyBatisPlus versions prior to a6a825513bd688f717dbae3a196bc9c9622fea26 Description: A critical vulnerability exists in the SysFileController function located at /file/upload within JoeyBling SpringBoot MyBatisPlus...

SpringBoot_MyBatisPlus code issues and vulnerabilities

SpringBootMyBatisPlus is a SpringBoot integration with MyBatisPlus by Siwei Zhou, an individual developer. A code issue vulnerability exists in SpringBootMyBatisPlus, which stems from a wrong operation of the parameter portraitFile in file/file/upload leading to arbitrary file uploads...

CVE-2025-6731

A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched...

CVE-2025-6731 yzcheng90 X-SpringBoot APK File apk uploadApk path traversal

A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched...

CVE-2025-6731

CVE-2025-6731 affects yzcheng90 X-SpringBoot up to version 5.0. The vulnerability resides in the function uploadApk within /sys/oss/upload/apk of the APK File Handler, where manipulation of the File argument enables path traversal. It can be exploited remotely, and the proof-of-concept/public exp...

CVE-2025-6731 yzcheng90 X-SpringBoot APK File apk uploadApk path traversal

A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched...

CVE-2025-6731: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched...

Malware in springboot-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in springboot-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 767553d0189c47e072ca2eccece5b848745a1f6faaf34987293d9232d32f48fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in springboot-md

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4888 Malicious code in springboot-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 767553d0189c47e072ca2eccece5b848745a1f6faaf34987293d9232d32f48fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4889 Malicious code in springboot-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a8c54ec931e96de6b2788e07cecb1d64ae325d3df32749035073a24f1a762c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in springboot-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a8c54ec931e96de6b2788e07cecb1d64ae325d3df32749035073a24f1a762c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WebStack-Guns security vulnerabilities

WebStack-Guns is an open source URL navigation website project by Dana Keeling, an individual developer, with a backend based on Guns and Springboot. A security vulnerability exists in WebStack-Guns version 1.0, which stems from vulnerability to cross-site request forgery attacks...

shiyi-blog security vulnerabilities

shiyi-blog is a vue+springboot front-end and back-end separated blog system by bule individual developer. A security vulnerability exists in shiyi-blog 1.2.1 and earlier versions, which stems from path traversal due to incorrect operation of the file/source parameter...

shiyi-blog security vulnerabilities

shiyi-blog is a vue+springboot front-end and back-end separated blog system by bule individual developer. A security vulnerability exists in shiyi-blog 1.2.1 and earlier versions, which stems from an improper authorization issue...

📄 Java-springboot-codebase 1.1 Arbitrary File Read

Java-sprintboot-codebase version 1.1 suffers from an arbitrary file read vulnerability. Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read Google Dork: Date: 23/May/2025 Exploit Author: d3sca Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase Software Link:...