xiaoheiFS vulnerabilities
2 known vulnerabilities in xiaoheiFS from Danvei233. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
0critical
2high
0exploited
7.2average CVSS score
Latest first
- 7.2 High severity
xiaoheiFS: Unrestricted Upload of File with Dangerous Type
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`q
- 7.2 High severity
xiaoheiFS: Improper Neutralization of Special Elements used in an OS Command
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `bi