CVE Intelligence

Hello-hao vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hello-hao products: 1 record(s), with severity, exploitation and fixes.

Tbed 1

Exploited only (KEV) →

CVE-2026-111674 Medium · 4.3 CWE-639 Oct 16, 2026
Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.