CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-08-26
ZK Framework AuUploader Component Sensitive Information Disclosure and RCE Vulnerability (CVE-2022-36537)
[Affected Scope] ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1, and prior
[Impact] Unauthenticated attackers can access sensitive system files and class resources via crafted POST requests, potentially leading to Remote Code Execution (RCE).
[Mitigation] Immediately upgrade ZK Framework to patched versions (9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or later) and block suspicious AuUploader requests via WAF.