Vulnerabilities

TI-2025-24465 CVE-2025-34336 · GHSA-7x97-5m4c-4jvm

eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints

LOW 37

eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00461 Published 2025-11-19 No fix listed CWE-434

TI-2025-24466 CVE-2025-34337 · GHSA-gwjq-fm88-774x

eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints

MEDIUM 43

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00226 Published 2025-11-19 No fix listed CWE-345

Vulnerabilities

Filters

eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints

eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints