| Título | linlinjava https://github.com/linlinjava/litemall <=1.8.0 Unrestricted Upload of File with Dangerous Type (CWE-434) |
|---|
| Descripción | The endpoint /admin/storage/create allow attacker uploads arbitrary type of file without sanitizer, which leads to Stored XSS, even RCE. |
|---|
| Fuente | ⚠️ https://github.com/linlinjava/litemall/issues/565 |
|---|
| Usuario | ZAST.AI (UID 87884) |
|---|
| Sumisión | 2025-08-04 09:17 (hace 9 meses) |
|---|
| Moderación | 2025-08-13 18:10 (9 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 319960 [linlinjava litemall hasta 1.8.0 Endpoint AdminStorageController.java create Archivo escalada de privilegios] |
|---|
| Puntos | 15 |
|---|