kekingcn/kkFileView

kekingcn/kkFileView

Releases26

Frequency3 months 4 weeks

Last Release about 2 months ago

Stars14.2K

Universal File Online Preview Project based on Spring-Boot

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-48815 ↗	Dec 4, 2023Monday, 4 December 2023, 15:15	6.1 MEDIUM	—
kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
CVE-2022-46934 ↗	Feb 1, 2023Wednesday, 1 February 2023, 20:15	6.1 MEDIUM	—
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVE-2022-43140 ↗	Nov 17, 2022Thursday, 17 November 2022, 17:15	7.5 HIGH	—
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.
CVE-2022-40879 ↗	Sep 29, 2022Thursday, 29 September 2022, 17:15	6.1 MEDIUM	—
kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
CVE-2022-36593 ↗	Sep 2, 2022Friday, 2 September 2022, 04:15	6.5 MEDIUM	—
kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.
CVE-2022-35151 ↗	Aug 17, 2022Wednesday, 17 August 2022, 22:15	6.1 MEDIUM	—
kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
CVE-2022-29349 ↗	May 25, 2022Wednesday, 25 May 2022, 01:15	6.1 MEDIUM	4.3 MEDIUM
kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVE-2021-43734 ↗	Feb 15, 2022Tuesday, 15 February 2022, 14:15	7.5 HIGH	5 MEDIUM
kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.