CVE-2025-4538 kkFileView fileUpload unrestricted upload

A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2025-4538

KKFileView 4.4.0 is affected by CVE-2025-4538 due to improper handling of the File argument in the /fileUpload endpoint, enabling unrestricted file uploads. The vulnerability permits remote initiation and, per disclosures, an exploit exists in public.

PT-2025-20660 · Unknown · Kkfileview

Name of the Vulnerable Software and Affected Versions: kkFileView version 4.4.0 Description: A critical issue affects an unknown part of the file /fileUpload. The manipulation of the File argument leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

kkFileView 代码问题漏洞

kkFileView is Kaijing Technology kekingcn open source Spring-Boot based on a generic file online preview project . kkFileView 4.4.0 version of the code problem vulnerability , the vulnerability stems from the file/fileUpload in the parameter File of the wrong operation leads to arbitrary file...

CVE-2023-48815

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

CVE-2023-48815

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

Improper access control

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

CVE-2023-48815

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

PT-2023-30966 · Unknown · Kkfileview

Name of the Vulnerable Software and Affected Versions: kkFileView version 4.3.0 Description: The issue is related to Incorrect Access Control. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

CVE-2023-48815

CVE-2023-48815 affects kkFileView v4.3.0 and is described as an Incorrect Access Control issue. The NVD entry provides CVSS 3.1: Network, Low Attack Complexity, No Privileges Required, User Interaction Required, Scope Changed, with Confidentiality and Integrity Impact Low, Availability Impact Non...

CVE-2023-48815

kkFileView v4.3.0 is vulnerable to Incorrect Access Control...

kkFileView Security Vulnerability

kkFileView is Kaijing Technology kekingcn open source Spring-Boot based on a generic file online preview project . kkFileView v4.3.0 version of a security vulnerability , the vulnerability stems from incorrect access control...

CVE-2022-46934

kkFileView v4.1.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

Cross site scripting

kkFileView v4.1.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

kkFileView 跨站脚本漏洞

Keking kkFileView is a Spring-Boot project to build online preview of documents by Keking Technology Keking. A security vulnerability exists in kkFileView v4.1.0, which stems from the /controller/OnlinePreviewController.java component's manipulation of the url parameter allowing an attacker to...

EUVD-2022-49713

kkFileView v4.1.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-46934

kkFileView v4.1.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-46934

kkFileView 4.1.0 is vulnerable to a Cross-Site Scripting (XSS) flaw in the url parameter of /controller/OnlinePreviewController.java. An attacker can inject arbitrary script into the victim’s browser, potentially stealing cookies or influencing page behavior. This aligns with multiple public repo...

CVE-2022-46934

kkFileView v4.1.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

kkFileView cross-site scripting vulnerability (CNVD-2023-00013)

kkFileView is China's Keking Technology Keking company's a Spring-Boot to create a file document online preview project . A cross-site scripting vulnerability exists in kkFileView, which stems from the setWatermarkAttribute function in the /picturesPreview file that allows an attacker to implemen...