Lamp Cloud
Approved changes feed: RSS · Atom
cpe:2.3:a:tangyh:lamp-cloud:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tangyh (fef91b4f-2d60-5441-85f6-f218f31b9376) |
|---|---|
| Product | Lamp Cloud (4cdcb8d5-6e12-54dd-9eef-e00debf10e99) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109166 |
vulnerable | 2026-11-03 10:17:40.196636 |
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
MEDIUM (6.5)
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.
Published: 2026-10-12T13:10:31.628Z
Updated: 2026-10-13T15:01:32.090Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109168 |
vulnerable | 2026-11-03 10:17:39.392253 |
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
MEDIUM (6.5)
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.
Published: 2026-10-12T13:10:32.919Z
Updated: 2026-10-13T18:37:18.904Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94534 |
vulnerable | 2026-10-13 12:28:38.903847 |
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
HIGH (7.1)
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
Published: 2026-09-21T21:28:13.569Z
Updated: 2026-09-22T17:45:03.746Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94535 |
vulnerable | 2026-10-13 12:28:38.879296 |
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
HIGH (7.1)
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.
Published: 2026-09-21T21:28:14.554Z
Updated: 2026-09-22T13:28:50.254Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94533 |
vulnerable | 2026-10-13 12:28:38.802976 |
lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
MEDIUM (6.5)
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
Published: 2026-09-21T21:28:12.305Z
Updated: 2026-09-22T13:02:43.860Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94536 |
vulnerable | 2026-10-13 12:28:38.722106 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94532 |
vulnerable | 2026-10-13 12:28:38.713893 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91996 |
vulnerable | 2026-09-16 04:32:55.490625 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31579 |
vulnerable | 2026-06-08 06:04:43.380984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.