Keking

Kkfileview

14 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2026-73244

  • EPSS 0.34%
  • Veröffentlicht 11.08.2026 20:08:25
  • Zuletzt bearbeitet 13.08.2026 15:20:12

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter fr...

5.8

CVE-2026-73243

  • EPSS 0.32%
  • Veröffentlicht 11.08.2026 20:04:38
  • Zuletzt bearbeitet 11.08.2026 21:17:52

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig....

9.8

CVE-2025-4538

  • EPSS 0.4%
  • Veröffentlicht 11.05.2025 10:31:04
  • Zuletzt bearbeitet 16.06.2025 18:31:48

A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotel...

6.1

CVE-2023-48815

Exploit
  • EPSS 0.46%
  • Veröffentlicht 04.12.2023 15:15:07
  • Zuletzt bearbeitet 21.11.2024 08:32:30

kkFileView v4.3.0 is vulnerable to Incorrect Access Control.

6.1

CVE-2022-46934

Exploit
  • EPSS 1.08%
  • Veröffentlicht 01.02.2023 20:15:10
  • Zuletzt bearbeitet 27.03.2025 16:15:16

kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.

6.1

CVE-2022-4740

Exploit
  • EPSS 0.55%
  • Veröffentlicht 25.12.2022 20:15:26
  • Zuletzt bearbeitet 21.11.2024 07:35:50

A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched ...

7.5

CVE-2022-43140

Exploit
  • EPSS 1.95%
  • Veröffentlicht 17.11.2022 17:15:13
  • Zuletzt bearbeitet 30.04.2025 14:15:25

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests v...

6.1

CVE-2022-42147

  • EPSS 0.42%
  • Veröffentlicht 17.10.2022 21:15:10
  • Zuletzt bearbeitet 14.05.2025 21:15:57

kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.

9.8

CVE-2022-42149

  • EPSS 2.33%
  • Veröffentlicht 17.10.2022 20:15:10
  • Zuletzt bearbeitet 14.05.2025 21:15:57

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

6.1

CVE-2022-40879

Exploit
  • EPSS 1.16%
  • Veröffentlicht 29.09.2022 17:15:54
  • Zuletzt bearbeitet 20.05.2025 20:15:24

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'