Vulnerabilities

TI-2025-04053 CVE-2025-4538 · GHSA-h26h-5ww8-xhfr

kkFileView fileUpload unrestricted upload

MEDIUM 57

A vulnerability was found in kkFileView 4.4.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00429 Published 2025-05-11 No fix listed CWE-284

TI-2023-26639 CVE-2023-48815 · GHSA-fjfw-648m-hm95

kkFileView v4.3.0 is vulnerable to Incorrect Access Control.

LOW 28

kkFileView v4.3.0 is vulnerable to Incorrect Access Control.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-12-04 No fix listed CWE-601

TI-2022-23251 CVE-2022-46934 · GHSA-6cfq-hcw2-7hq2

kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability…

MEDIUM 60

kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01084 Published 2023-02-01 No fix listed CWE-79

TI-2022-04336 CVE-2022-4740 · GHSA-9vpf-fvq4-6558

kkFileView picturesPreview setWatermarkAttribute cross site scripting

LOW 28

A vulnerability, which was classified as problematic, has been found in kkFileView.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00584 Published 2022-12-25 No fix listed CWE-79

TI-2022-21050 CVE-2022-43140 · GHSA-hxhg-m762-rjxh

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

HIGH 72

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02119 Published 2022-11-17 No fix listed CWE-918

TI-2022-20422 CVE-2022-42149 · GHSA-v6hf-4fpr-7xxc

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

HIGH 75

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02704 Published 2022-10-17 No fix listed CWE-918

TI-2022-20421 CVE-2022-42147 · GHSA-gmv4-3g7h-46qx

kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.

MEDIUM 60

kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00496 Published 2022-10-17 No fix listed CWE-79

TI-2022-19461 CVE-2022-40879 · GHSA-v632-53j2-53ph

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'

MEDIUM 60

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01346 Published 2022-09-29 No fix listed CWE-79

TI-2022-16898 CVE-2022-36593 · GHSA-x7ww-46rr-g74m

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via…

LOW 31

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00928 Published 2022-09-02 No fix listed CWE-22

TI-2022-15864 CVE-2022-35151 · GHSA-r736-2rjg-v25x

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS)…

LOW 31

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01632 Published 2022-08-17 No fix listed CWE-79

TI-2022-11849 CVE-2022-29349 · GHSA-ccv3-c7pp-3326

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability…

LOW 31

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0175 Published 2022-05-24 No fix listed CWE-79

TI-2021-19548 CVE-2021-43734 · GHSA-jp89-xgxv-777w

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability…

MEDIUM 46

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10728 Published 2022-02-15 No fix listed CWE-22

Vulnerabilities

Filters