Keking maintains a modestly represented but prominently tracked file-viewing and document-conversion platform, KKFileView, that sits at the content-processing boundary in many web applications and enterprise systems. The vendor's vulnerabilities skew toward serious outcomes and have a strong, recurring history of public exploit availability, reflecting the platform's role as an internet-accessible document handler and its exposure to input-driven attack surfaces. The exposure recurs across boundary-crossing weakness classes including cross-site scripting, path traversal, server-side request forgery, improper access control, and open redirect, which are characteristic of document-processing and file-serving interfaces. Defenders should prioritize this vendor's advisories and treat exposed instances as a high-patching priority; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Keking over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-42149CRITICAL kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. | Oct 17, 2022 | 9.8 | 40 | NO | YES |
CVE-2021-43734HIGH kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. | Feb 15, 2022 | 7.5 | 40 | NO | YES |
CVE-2022-43140HIGH kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability | Nov 17, 2022 | 7.5 | 35 | NO | YES |
CVE-2022-35151MEDIUM kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. | Aug 17, 2022 | 6.1 | 31 | NO | YES |
CVE-2022-29349MEDIUM kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | May 25, 2022 | 6.1 | 31 | NO | YES |
CVE-2022-46934MEDIUM kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | Feb 1, 2023 | 6.1 | 30 | NO | YES |
CVE-2025-4538CRITICAL A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads | May 11, 2025 | 9.8 | 27 | NO | NO |
CVE-2022-40879MEDIUM kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.' | Sep 29, 2022 | 6.1 | 25 | NO | YES |
CVE-2022-36593MEDIUM kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java. | Sep 2, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-4740MEDIUM A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The m | Dec 25, 2022 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Keking.
Media articles that mention a CVE ID that affects a product developed by Keking — matched by CVE ID, not by vendor name.