Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,612
- Last 24h
- 513
- Critical, 7 days
- 343
- Known exploited
- 1,779
108,069 results · Clear filters · Feed
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, a…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST craft…
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the ha…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles wit…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announ…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryB…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every…
-
Medium 4.3
JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply anoth…
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/k…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt templa…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecy…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit w…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded lis…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen te…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values i…
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign an…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus fi…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userI…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to r…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can itera…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virt…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRoles…
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bu…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass th…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a nod…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and chi…
-
Medium 4.3
JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list a…
-
Medium 4.3
JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids f…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict…