CVE-2024-25808

A Cross-site Request Forgery (CSRF) vulnerability exists in Lychee version 3.1.6 , an open-source photo management system. This flaw allows remote attackers to execute arbitrary code specifically via the create new album function, potentially leading to unauthorized actions on the affected system...

CVE-2024-25807

A Cross Site Scripting (XSS) vulnerability exists in Lychee version 3.1.6 , an open-source photo management system. The flaw is located in the title parameter used during the album creation process. Remote attackers can exploit this to execute arbitrary code and obtain sensitive information. As o...

PT-2024-21141 · Lychee · Lychee

Name of the Vulnerable Software and Affected Versions: Lychee version 3.1.6 Description: A Cross-site Request Forgery CSRF issue allows remote attackers to execute arbitrary code via the create new album function. This can be exploited to perform unauthorized actions on the affected system...

PT-2024-21140 · Lychee · Lychee

Name of the Vulnerable Software and Affected Versions: Lychee version 3.1.6 Description: The issue allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. This is a Cross Site Scripting XSS issue. Recommendations: For Lych...

CVE-2023-52082

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

Sql injection

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries.

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries.

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries.

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082

Lychee (free photo-management tool) is vulnerable to an SQL injection in explain DB queries on MySQL/MariaDB bindings prior to version 5.0.2. The vulnerability requires DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true in .env to be active. The default Lychee settings are safe. A patch is available in ...

CVE-2023-52082

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082: Improper Neutralization of Special Elements used in an SQL Command

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

Lychee SQL Injection Vulnerability

Lychee is a beautiful and easy to use photo management system from The Lychee Organisation open source. Used to manage and share photos . Lychee versions prior to 5.0.2 SQL injection vulnerability , the vulnerability stems from the component mysql/mariadb SQL injection vulnerability...

PT-2023-31914

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 5.0.2 Description Lychee, a free photo-management tool, is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB LOG SQL=true a...

Lychee Cross-Site Scripting Vulnerability

Lychee is a beautiful and easy to use photo management system open sourced by The Lychee Organisation. Lychee has a cross-site scripting vulnerability, and no details of the vulnerability are available...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...

Cross site scripting

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The issue arises because the exit path prints a message to the user that includes albumID, which is controllable by the attacker. Affected component: Lychee-v3, version 3.2.16; vulnerable function/...