baowzh hfly vulnerabilities

A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php. Manipulation of the argument imgFile results in unrestricted upload. The attack can be initiated remotely, and the exploit is now public and may be used.

A vulnerability in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c affects an unknown function in the file /admin/index.php/datafile/download. Manipulating the filename argument leads to path traversal. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c affects an unknown function in the file /admin/index.php/datafile/delfile. Manipulating the filename argument causes path traversal. The attack can be performed remotely, and the exploit has been publicly disclosed.