Skip to content
OpenAdvisories

Vendor

anji-plus

9 known vulnerabilities.

Products

AJ-Report 9
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-120209 Public exploit

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…

    anji-plus AJ-Report