Skip to content
OpenAdvisories

Vendor

dromara

62 known vulnerabilities.

Products

lamp-cloud 14 UJCMS 7 hertzbeat 6 RuoYi-Vue-Plus 6 Jpom 5 MaxKey 4 skyeye 4 mayfly-go 2 orion-visor 2 J2eeFAST 2 HuTool 2 Sa-Token 2 warm-flow 1 RuoYi-Cloud-Plus 1 dataCompare 1 open-capacity-platform 1 domain-admin 1 Northstar 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.1
    CVE-2025-15117

    Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization

    A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is c…

    dromara Sa-Token
  • Low 2.4
    CVE-2025-2491

    Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting

    A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation…

    dromara UJCMS
  • Low 2.4
    CVE-2025-2490

    Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

    A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The …

    dromara UJCMS
  • Low 3.7
    CVE-2024-12483 Public exploit

    Dromara UJCMS User ID id authorization

    A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack r…

    dromara UJCMS
  • Low 3.5
    CVE-2023-2476

    Dromara J2eeFAST Announcement cross site scripting

    A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads to cross site scripting. It is possible t…

    dromara J2eeFAST
  • Low 3.5
    CVE-2023-2475

    Dromara J2eeFAST System Message cross site scripting

    A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be i…

    dromara J2eeFAST