Vulnerabilidades en LycheeOrg
18 resultadosCVE-2025-50202HIGHLychee Path Traversal VulnerabilityEPSS 0.6%CVE-2023-52082HIGHLychee is vulnerable to an SQL Injection in explain DB queries.EPSS 0.5%CVE-2026-61611HIGHLychee: Missing rate limiting on album password unlock endpoint allows brute-force attacksEPSS 0.5%CVE-2026-77470HIGHLychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST requestEPSS 0.5%CVE-2026-77466HIGHLychee: Webshop payment bypass via unrestricted "Dummy" gateway selectionEPSS 0.4%CVE-2026-61838HIGHLychee: Album password bypass in ZIP downloadsEPSS 0.4%CVE-2026-77468MEDIUMLychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/apiEPSS 0.4%CVE-2026-62679HIGHLychee: Path traversal in `SecurePathController` allows authenticated arbitrary file readEPSS 0.4%CVE-2026-77467HIGHLychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing pathEPSS 0.3%CVE-2026-61610LOWLychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymousEPSS 0.3%CVE-2026-57568MEDIUMLychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)EPSS 0.3%CVE-2026-22784LOWLychee cross-album password propagation on Album unlockingEPSS 0.3%CVE-2026-33537MEDIUMLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedEPSS 0.3%CVE-2026-57569LOWLychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validationEPSS 0.2%CVE-2026-33644LOWLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPsEPSS 0.2%CVE-2026-33738MEDIUMLychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)EPSS 0.2%CVE-2026-39957LOWLychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized usersEPSS 0.2%CVE-2025-53018LOWLychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLsEPSS 0.2%