Skip to content
OpenAdvisories

Vendor

anji-plus

9 known vulnerabilities.

Products

AJ-Report 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-120209 Public exploit

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…

    anji-plus AJ-Report
  • Medium 6.3
    CVE-2024-5356 Public exploit

    anji-plus AJ-Report testTransform;swagger-ui sql injection

    A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible…

    anji-plus AJ-Report