YiShaAdmin vulnerabilities

CVEs whose affected-version data names the YiShaAdmin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2022-51022Critical· 9.1

today

YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. A…

▾ Midnightliukuo362573 · YiShaAdminvia CVEORG