LycheeOrg records

9 published records for vendor lycheeorg.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 22.2%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-52082No exploit	Lychee is vulnerable to an SQL Injection in explain DB queries.lycheeorg · lychee · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.5%	Dec 28, 2023
33Monitor	CVE-2024-25808No exploit	Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create nelycheeorg · lychee · CWE-352 pre-auth RCE CSRF	High8.3	—	0.4%	Mar 22, 2024
24Monitor	CVE-2021-43675No exploit	Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.lycheeorg · lychee · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Dec 15, 2021
24Monitor	CVE-2024-25807No exploit	Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive informationlycheeorg · lychee · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.5%	Mar 21, 2024
21Monitor	CVE-2026-33537No exploit	Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedlycheeorg · lychee · CWE-918 SSRF	Medium5.3	—	0.3%	Mar 26, 2026
19Monitor	CVE-2026-33738No exploit	Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)lycheeorg · lychee · CWE-79 Auth bypass XSS	Medium4.8	—	0.4%	Mar 26, 2026
9Monitor	CVE-2026-39957No exploit	Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized userslycheeorg · lychee · CWE-863 Broken access control (IDOR)	Low2.3	—	0.3%	Apr 9, 2026
9Monitor	CVE-2026-33644No exploit	Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPslycheeorg · lychee · CWE-918 SSRF	Low2.3	—	0.3%	Mar 26, 2026
9Monitor	CVE-2026-22784No exploit	Lychee cross-album password propagation on Album unlockinglycheeorg · lychee · CWE-863 Pre-auth Broken access control (IDOR)	Low2.3	—	0.3%	Jan 12, 2026

CVE-2023-52082
39Monitor
Lychee is vulnerable to an SQL Injection in explain DB queries.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
lycheeorg · lycheeDec 28, 2023
CVE-2024-25808
33Monitor
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create ne
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- CSRF
lycheeorg · lycheeMar 22, 2024
CVE-2021-43675
24Monitor
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
lycheeorg · lycheeDec 15, 2021
CVE-2024-25807
24Monitor
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
lycheeorg · lycheeMar 21, 2024
CVE-2026-33537
21Monitor
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
MediumCVSS 5.3No exploitEPSS 0%
- SSRF
lycheeorg · lycheeMar 26, 2026
CVE-2026-33738
19Monitor
Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
MediumCVSS 4.8No exploitEPSS 0%
- Auth bypass
- XSS
lycheeorg · lycheeMar 26, 2026
CVE-2026-39957
9Monitor
Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users
LowCVSS 2.3No exploitEPSS 0%
- Broken access control (IDOR)
lycheeorg · lycheeApr 9, 2026
CVE-2026-33644
9Monitor
Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs
LowCVSS 2.3No exploitEPSS 0%
- SSRF
lycheeorg · lycheeMar 26, 2026
CVE-2026-22784
9Monitor
Lychee cross-album password propagation on Album unlocking
LowCVSS 2.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
lycheeorg · lycheeJan 12, 2026