mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/i7MEDIA/mojoportal | Product |
| https://www.0xlanks.me/blog/cve-2025-28367-advisory/ | Exploit Third Party Advisory Patch |
Configurations
History
23 Jun 2025, 13:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/i7MEDIA/mojoportal - Product | |
| References | () https://www.0xlanks.me/blog/cve-2025-28367-advisory/ - Exploit, Third Party Advisory, Patch | |
| First Time |
Mojoportal mojoportal
Mojoportal |
|
| CPE | cpe:2.3:a:mojoportal:mojoportal:*:*:*:*:*:*:*:* |
21 Apr 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-21 16:15
Updated : 2025-06-23 13:14
NVD link : CVE-2025-28367
Mitre link : CVE-2025-28367
JSON object : View
Products Affected
mojoportal
- mojoportal
CWE
No CWE.