CVE-2013-3650

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654.

• CWE-22

• http://jvn.jp/en/jp/JVN43886811/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2013-000061
• http://svn.ec-cube.net/open_trac/changeset/22863Vendor Advisory
• http://www.ec-cube.net/info/weakness/20130626/index.phpVendor Advisory
• http://www.ec-cube.net/info/weakness/weakness.php?id=48Vendor Advisory
• http://jvn.jp/en/jp/JVN43886811/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2013-000061
• http://svn.ec-cube.net/open_trac/changeset/22863Vendor Advisory
• http://www.ec-cube.net/info/weakness/20130626/index.phpVendor Advisory
• http://www.ec-cube.net/info/weakness/weakness.php?id=48Vendor Advisory

Published

Jun 30, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-3644Unspecified vulnerability in JustSystems Ichitaro 2006 throu…
• CVE-2013-3645Cross-site scripting (XSS) vulnerability in the Orchard.Comm…
• CVE-2013-3646The Cybozu Live application before 2.0.1 for Android allows …
• CVE-2013-3647The WebView class in the Cybozu Live application before 2.0.…
• CVE-2013-3648Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MA…
• CVE-2013-3649Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MA…
• CVE-2013-3651LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers…
• CVE-2013-3652Cross-site scripting (XSS) vulnerability in data/class/pages…
• CVE-2013-3653Multiple cross-site scripting (XSS) vulnerabilities in the R…
• CVE-2013-3654Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 t…
• CVE-2013-3655The Sharp AQUOS PhotoPlayer HN-PP150 with firmware before 1.…
• CVE-2013-3656Cybozu Office 9.1.0 and earlier does not properly manage ses…