CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

lemon 安全漏洞

lemon is an open source OA by Xu Huisheng individual developer. A security vulnerability exists in lemon 1.13.0 and earlier versions, which originates from the improper handling of the Upload parameter in the uploadImage function in the file CmsArticleController.java, which may lead to unlimited...

CVE-2025-9406: Unrestricted Upload of File with Dangerous Type

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

Kaseya KServer 安全漏洞

Kaseya KServer is a central server node for a management system from Kaseya Corporation, USA. A security vulnerability exists in Kaseya KServer versions prior to 6.3.0.2, which stems from an unauthenticated and uncleaned uploadImage.asp endpoint that could lead to arbitrary file uploads and remot...

CVE-2024-7813: Insufficiently Protected Credentials

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials...

CVE-2024-7706 Fujian mwcms uploadfile.html uploadimage unrestricted upload

A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclose...

CVE-2024-7706: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclose...

CVE-2024-6084 itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/modroom/controller.php?action=add. The manipulation of the argument image leads to...

CVE-2024-6084 itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/modroom/controller.php?action=add. The manipulation of the argument image leads to...

CVE-2024-6084: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/modroom/controller.php?action=add. The manipulation of the argument image leads to...

CVE-2024-22523

Directory Traversal vulnerability in Qiyu iFair version 23.8ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component...

CVE-2024-22523

Directory Traversal vulnerability in Qiyu iFair version 23.8ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component...

Directory traversal

Directory Traversal vulnerability in Qiyu iFair version 23.8ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component...

CVE-2024-22523

Directory Traversal vulnerability in Qiyu iFair version 23.8ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component...

Qiyu iFair Security Breach

Qiyu iFair is a business management software from Qiyu Inc. A security vulnerability exists in Qiyu iFair version 23.8ad0 and prior versions. A remote attacker can exploit this vulnerability to obtain sensitive information via the uploadimage component...

PT-2024-19465 · Unknown · Qiyu Ifair

Name of the Vulnerable Software and Affected Versions: Qiyu iFair versions 23.8 ad0 and earlier Description: The issue allows remote attackers to obtain sensitive information via the uploadimage component. This is a Directory Traversal vulnerability, which means that attackers can access files an...

CVE-2024-22523

CVE-2024-22523 affects Qiyu iFair,

CVE-2024-22523: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in Qiyu iFair version 23.8ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component...

Design/Logic Flaw

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...

CVE-2022-24837: Exposure of Sensitive Information to an Unauthorized Actor

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...