Kingdee EAS - Local File Inclusion Detection

Kingdee EAS OA serverfile is vulnerable to local file inclusion and can allow attackers to obtain sensitive server information. !/usr/bin/env python3 -- coding: utf-8 -- """Kingdee EAS OA serverfile is vulnerable to local file inclusion and can allow attackers to obtain sensitive s.""" from...

Kingdee OA Yunxingkong kdsvc - Remote Code Execution Detection

Kingdee OA Yunxingkong has a remote command execution vulnerability. This vulnerability is caused by the fact that the communication layer of Kingdee Cloud Starry Sky Management Center adopts binary data format by default, which requires serialization and deserialization. No signature or...

EUVD-2021-23846

Malware in sbrugna...

EUVD-2025-23519

Malicious code in bioql PyPI...

EUVD-2025-19258

Malicious code in bioql PyPI...

EUVD-2025-16008

Malicious code in bioql PyPI...

CVE-2025-8516

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...

CVE-2025-8516

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...

CVE-2025-8516

CVE-2025-8516 affects Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. The vulnerability is in BaseServiceFactory.getFileUploadService.deleteFileAction within K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the IIS-K...

CVE-2025-8516 Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...

CVE-2025-8516 Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...

CVE-2025-8516: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...

PT-2025-31821

Name of the Vulnerable Software and Affected Versions Kingdee Cloud-Starry-Sky Enterprise Edition versions prior to 8.3 Description A security issue exists in Kingdee Cloud-Starry-Sky Enterprise Edition. The BaseServiceFactory.getFileUploadService.deleteFileAction function within the...

Kingdee Cloud-Starry-Sky Enterprise Edition Path Traversal Vulnerability

Kingdee Cloud-Starry-Sky Enterprise Edition is a digital transformation solution for growing enterprises from China's Kingdee. A path traversal vulnerability exists in Kingdee Cloud-Starry-Sky Enterprise Edition 8.2 and earlier versions, which stems from path traversal due to incorrect operation ...

CVE-2025-6761

A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The...

CVE-2025-6761

A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The...

CVE-2025-6761 Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine

A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The...

CVE-2025-6761 Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine

A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The...

CVE-2025-6761

CVE-2025-6761 affects Kingdee Cloud-Starry-Sky Enterprise Edition (versions 6.x–9.0). The root cause is improper neutralization of special elements in the Freemarker Engine template processing, specifically in the function plugin.buildMobilePopHtml inside DynamicForm 4 Action.class. This can enab...

CVE-2025-6761: Improper Neutralization of Special Elements Used in a Template Engine

A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The...