1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the...
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha
#cwe-862
共收录 3939 条相关情报。
← 返回所有主题CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form...
CVE-2026-108705
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the...
CVE-2026-108706
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource...
CVE-2026-108703
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval...
CVE-2026-108702
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows...
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in...
CVE-2026-108692
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldControll
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController...
CVE-2026-108688
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler t
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scop...
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs ...
CVE-2026-108706
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any cust...
CVE-2026-108705
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval withou...
CVE-2026-108703
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests ...
CVE-2026-108702
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission...
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-t...
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission...
CVE-2026-108692
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldControll
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass t...
CVE-2026-108688
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler t
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the...
CVE-2026-108673
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler t
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any...
CVE-2026-108671
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP se
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the...
CVE-2026-108676
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles ha