24 matches found
CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...
EUVD-2026-81575
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...
CVE-2026-92920
admin3 (a Java-based admin framework) through 3.0.0 fails to invalidate existing sessions when a user account is disabled. The root cause lies in the AuthInterceptor , which never re-validates a user's locked status, and the LocalSessionManager , which resets session expiry on each request. As a ...
EUVD-2024-53727
Malicious code in bioql PyPI...
EUVD-2024-33707
Malicious code in bioql PyPI...
CVE-2024-27764
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component...
CVE-2024-11251
A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begindate leads to sql injection. The attack may be initiat...
CVE-2024-57757
JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...
CVE-2024-57757
JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...
CVE-2024-57757
JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...
CVE-2024-57757
JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...
JeeWMS 安全漏洞
JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS versions prior to v2025.01.01. An attacker exploiting this vulnerability can bypass privileges via component/authInterceptors/AuthInterceptor.cava...
CVE-2024-57757
JeeWMS (pre-2025.01.01) contains a permission bypass in the component /interceptors/AuthInterceptor.cava. The issue enables elevated access without user interaction and is reported with a CVSS 3.1 vector targeting high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected version...
CVE-2024-11251
A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begindate leads to sql injection. The attack may be initiat...
CVE-2024-11251
The CVE-2024-11251 entry concerns erzhongxmu Jeewms (up to 20241108). The issue is a SQL injection in the cgReportController.do file, affecting the AuthInterceptor component via manipulation of the begin_date argument. It is described as remotely initiable, with the exploit disclosed publicly; ve...
CVE-2024-11251 erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection
A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begindate leads to sql injection. The attack may be initiat...
CVE-2024-11251 erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection
A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begindate leads to sql injection. The attack may be initiat...
CVE-2024-27764
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component...
