12 matches found
CVE-2026-108688
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
EUVD-2026-96713
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
CVE-2026-108688
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
CVE-2026-108688
Eladmin versions through 2.7 are vulnerable to a missing authorization flaw in the LocalStorageController uploadPicture handler. This allows low-privileged authenticated users to bypass the storage:add permission. By sending POST requests with image-named files to /api/localStorage/pictures, an a...
PT-2026-109982
Name of the Vulnerable Software and Affected Versions Eladmin versions prior to 2.8 Description Low-privileged authenticated users can bypass the storage:add permission due to missing authorization in the uploadPicture handler of the LocalStorageController. By sending POST requests containing fil...
CVE-2026-108688: Missing Authorization
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...
ELADMIN 授权问题漏洞
ELADMIN is a backend management system for elunez individual developers. An authorization issue vulnerability exists in ELADMIN version 1.1, which stems from improper authorization of the function deleteFile in the component LocalStorageController...
CVE-2025-9937: Improper Authorization
A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited...
CVE-2025-3410 mymagicpower AIAS LocalStorageController.java unrestricted upload
A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file trainingplatform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of the argument File leads to unrestricted...
CVE-2025-3410 mymagicpower AIAS LocalStorageController.java unrestricted upload
A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file trainingplatform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of the argument File leads to unrestricted...