CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2025-2219 – LoveCards LoveCardsV2 image unrestricted upload
https://notcve.org/view.php?id=CVE-2025-2219
12 Mar 2025 — A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/image. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://ctf-n0el4kls.notion.site/LoveCardsV2-Unauthentication-to-RCE-Vulnerability-19841990f44780de8263c1f77a007a83 • CWE-284: Improper Access Control CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 1CVE-2025-2218 – LoveCards LoveCardsV2 Setting other access control
https://notcve.org/view.php?id=CVE-2025-2218
12 Mar 2025 — A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://ctf-n0el4kls.notion.site/LoveCardsV2-Unauthentication-to-RCE-Vulnerability-19841990f44780de8263c1f77a007a83?pvs=4 • CWE-266: Incorrect Privilege Assignment CWE-284: Improper Access Control •