kkFileView
by kekingcn
CVEs (12)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-42149 | Cri | 0.64 | 9.8 | 0.02 | Oct 17, 2022 | kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. | ||
| CVE-2021-43734 | Hig | 0.50 | 7.5 | 0.11 | Feb 15, 2022 | kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. | ||
| CVE-2022-43140 | Hig | 0.49 | 7.5 | 0.02 | Nov 17, 2022 | kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs… | ||
| CVE-2022-36593 | Med | 0.42 | 6.5 | 0.01 | Sep 2, 2022 | kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java. | ||
| CVE-2025-4538 | Med | 0.41 | 6.3 | 0.00 | May 11, 2025 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been… | ||
| CVE-2023-48815 | Med | 0.40 | 6.1 | 0.00 | Dec 4, 2023 | kkFileView v4.3.0 is vulnerable to Incorrect Access Control. | ||
| CVE-2022-46934 | Med | 0.40 | 6.1 | 0.01 | Feb 1, 2023 | kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||
| CVE-2022-42147 | Med | 0.40 | 6.1 | 0.00 | Oct 17, 2022 | kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. | ||
| CVE-2022-40879 | Med | 0.40 | 6.1 | 0.01 | Sep 29, 2022 | kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.' | ||
| CVE-2022-35151 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2022 | kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. | ||
| CVE-2022-29349 | Med | 0.40 | 6.1 | 0.02 | May 25, 2022 | kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||
| CVE-2022-4740 | Low | 0.23 | 3.5 | 0.01 | Dec 25, 2022 | A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has… |
- risk 0.64cvss 9.8epss 0.02
kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
- risk 0.50cvss 7.5epss 0.11
kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
- risk 0.49cvss 7.5epss 0.02
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs…
- risk 0.42cvss 6.5epss 0.01
kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been…
- risk 0.40cvss 6.1epss 0.00
kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
- risk 0.40cvss 6.1epss 0.00
kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
- risk 0.40cvss 6.1epss 0.02
kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
- risk 0.23cvss 3.5epss 0.01
A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has…