CVE Intelligence

Hello-hao Tbed vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Hello-hao Tbed: 1 record(s), with affected versions and fixes.

CVE-2026-111674 Medium · 4.3 CWE-639 Oct 16, 2026
Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.