182 matches found
CVE-2026-73243 kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...
CVE-2026-73243
kkFileView (Spring Boot-based) prior to version 5.0.1 is vulnerable to unauthenticated SSRF via GET /addTask. The issue arises because this endpoint was omitted from TrustHostFilter and TrustDirFilter in WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-controlled URL after FileH...
CVE-2026-73243: Server-Side Request Forgery (SSRF)
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...
PT-2026-70912
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...
PT-2026-70911
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...
CVE-2026-73244: Improper Limitation of a Pathname to a Restricted Directory
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...
kkFileView 4.1.0 - Cross-Site Scripting Detection
kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...
kkFileview v4.0.0 - Local File Inclusion Detection
kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileview v4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...
kkFileView 4.1.0 - Cross-Site Scripting Detection
kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...
kkFileView 4.0.0 - Cross-Site Scripting Detection
kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileView 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
kkFileView Panel - Detect
kkFileView panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileView panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'kkFileView Panel - Detect', 'description': 'kkFileView panel...
kkFileView 4.1.0 - Cross-Site Scripting Detection
kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileView 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
CVE-2022-42149
kkFileView 4.0 is vulnerable to Server-side request forgery SSRF via controller\OnlinePreviewController.java...
CVE-2022-35151
kkFileView v4.1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java...
EUVD-2022-52040
Malicious code in bioql PyPI...
EUVD-2022-33691
Malicious code in bioql PyPI...
EUVD-2022-39298
Malicious code in bioql PyPI...
EUVD-2025-14254
Malicious code in bioql PyPI...