CVE-2020-20597

The CVE-2020-20597 entry concerns a cross-site scripting (XSS) vulnerability in Lemon OA version 1.10.0, affecting the potrtalItemName parameter in webPortalController.java. Public descriptions across NVD/Red Hat CNVD/etc confirm the root cause is unescaped user input in that parameter, enabling ...

CVE-2020-20598

The vulnerability is in Lemon OA v1.10.0, specifically in the Editing component, where a cross-site scripting (XSS) flaw enables attackers to execute arbitrary web scripts or HTML. Root cause is an XSS in the Editing module; context and exact vulnerable entry points are not detailed in the provid...

CVE-2018-18315

The CVE-2018-18315 entry concerns lemon 1.9.0. A vulnerability in com/mossle/cdn/CdnController.java involves the copyMultipartFileToFile method in CdnUtils, which only checks for a ../ substring and does not validate the file type or the spaceName parameter. This inadequate validation can allow a...

CVE-2025-9406

A vulnerability is identified in xuhuisheng lemon up to 1.13.0 affecting the uploadImage function in CmsArticleController.java (com.mossle.cms.web.CmsArticleController.uploadImage). The Upload argument is manipulated to enable unrestricted uploads, with remote initiation and a publicly available ...