CVE-2025-11607: falha de média gravidade em harry0703 MoneyPrinterTurbo
harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing a manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
harry0703 · MoneyPrinterTurboCVEs relacionadas — harry0703 MoneyPrinterTurbo
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10472MEDIUMharry0703 MoneyPrinterTurbo URL video.py stream_video path traversalEPSS 0.8%CVE-2025-7897MEDIUMharry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authenticationEPSS 0.7%CVE-2025-7896MEDIUMharry0703 MoneyPrinterTurbo video.py delete_video path traversalEPSS 0.5%CVE-2025-7895MEDIUMharry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted uploadEPSS 0.5%