CVE-2025-11607: fallo de gravedad media en harry0703 MoneyPrinterTurbo
harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing a manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
harry0703 · MoneyPrinterTurboCVEs relacionadas — harry0703 MoneyPrinterTurbo
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-10472MEDIUMharry0703 MoneyPrinterTurbo URL video.py stream_video path traversalEPSS 0.8%CVE-2025-7897MEDIUMharry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authenticationEPSS 0.7%CVE-2025-7896MEDIUMharry0703 MoneyPrinterTurbo video.py delete_video path traversalEPSS 0.5%CVE-2025-7895MEDIUMharry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted uploadEPSS 0.5%