EUVD-2026-97374

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and...

CVE-2026-109168

The lamp-cloud software (versions through 5.10.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw allows authenticated users to access file attachments belonging to other business objects by providing an arbitrary bizId to the listFileByBizId endpoint. Impa...