linqi
Products
1- 10 CVEs
Recent CVEs
10| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-33868 | Cri | 0.64 | 9.8 | 0.01 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection. | ||
| CVE-2024-33863 | Cri | 0.64 | 9.8 | 0.01 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion. | ||
| CVE-2026-11347 | Hig | 0.55 | — | 0.00 | Jun 5, 2026 | The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with… | ||
| CVE-2024-33865 | Hig | 0.49 | 7.5 | 0.01 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints. | ||
| CVE-2026-11369 | Hig | 0.46 | — | 0.00 | Jun 5, 2026 | The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability… | ||
| CVE-2026-11345 | Med | 0.45 | — | 0.00 | Jun 5, 2026 | An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256… | ||
| CVE-2024-33864 | Med | 0.38 | 5.9 | 0.00 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript. | ||
| CVE-2024-33866 | Med | 0.36 | 5.5 | 0.00 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS. | ||
| CVE-2026-11346 | Med | 0.34 | — | 0.00 | Jun 5, 2026 | A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe internal network components. By crafting a specific process containing an HTTP Request component, an attacker can force the server to send… | ||
| CVE-2024-33867 | Med | 0.31 | 4.8 | 0.00 | May 14, 2024 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt. |
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion.
- risk 0.55cvss —epss 0.00
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.
- risk 0.46cvss —epss 0.00
The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability…
- risk 0.45cvss —epss 0.00
An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256…
- risk 0.38cvss 5.9epss 0.00
An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript.
- risk 0.36cvss 5.5epss 0.00
An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.
- risk 0.34cvss —epss 0.00
A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe internal network components. By crafting a specific process containing an HTTP Request component, an attacker can force the server to send…
- risk 0.31cvss 4.8epss 0.00
An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.