Vendors / Luckyframe Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 2
Exploited now Luckyframe records in CISA KEV No Luckyframe vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 50
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00782 · Published 2023-02-17 · No fix listed CWE-89
Priority MEDIUM 50
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00782 · Published 2023-02-17 · No fix listed CWE-89
Priority MEDIUM 50
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00782 · Published 2023-02-17 · No fix listed CWE-89
Priority LOW 39
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00461 · Published 2024-05-23 · No fix listed CWE-22
Priority LOW 38
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00249 · Published 2024-05-06 · No fix listed CWE-494
Open these records in search → All records by CVSS severity
3 2 0 0 0
THREATIST.IORead the docs