105 matches found
AJ-Report < 1.4.1 - Remote Code Execution
AJ-Report before version 1.4.1 is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java code on the victim server through script engine injection in the validation rul...
CVE-2026-120209
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...
EUVD-2026-114730
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...
CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...
CVE-2026-120209
The AJ-Report software (through version 1.7.1) is vulnerable to an authentication bypass leading to remote code execution (RCE) . The root cause is the use of a hard-coded JWT secret to sign share tokens, which allows attackers to forge valid tokens offline. By minting a token with the reportCode...
CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...
Aj-Report-sql-CVE-2024-5356-POC
exp.py -u specifies URL or -f specifies file for batch detection, -t specifies threads, -h for help Usage pi install requirements.txt python exp.py -u 目标url -t 10 python exp.py -h Notes Ensure the URL starts with http:// or https://, otherwise an error will occur and cannot execute...
PT-2026-134528
Name of the Vulnerable Software and Affected Versions AJ-Report versions 1.0 through 1.7.1 Description The software uses a hard-coded JWT secret to sign share tokens, which enables attackers to forge valid tokens offline. By creating a token with the reportCode variable set to 'dataSet', an...
CVE-2026-120209: anji-plus AJ-Report: AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens…
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...
EUVD-2024-46575
Malicious code in bioql PyPI...
EUVD-2024-46576
Malicious code in bioql PyPI...
EUVD-2024-46580
Malicious code in bioql PyPI...
EUVD-2024-46577
Malicious code in bioql PyPI...
EUVD-2024-46581
Malicious code in bioql PyPI...
EUVD-2024-46579
Malicious code in bioql PyPI...
CVE-2024-52786
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL...
CVE-2024-52786
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL...
CVE-2024-52786
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL...
AJ-Report Security Vulnerabilities
AJ-Report is an open source visual design tool from anji-plus. A security vulnerability exists in AJ-Report 1.4.2 and earlier versions, which stems from an authentication bypass that could lead to the execution of arbitrary code...
CVE-2024-52786: Improper Control of Generation of Code
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL...