PT-2025-31873 · Exrick · Exrick Xboot

Name of the Vulnerable Software and Affected Versions: Exrick xboot versions through 3.3.4 Description: A problematic issue has been identified in Exrick xboot. The issue resides in an unknown function within the /xboot/permission/getMenuList file. Manipulation of this function results in the...

CVE-2025-8526: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to...

CVE-2025-8525: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been...

PT-2025-31864 · Exrick +1 · Exrick Xboot +2

Name of the Vulnerable Software and Affected Versions: Exrick xboot versions up to 3.3.4 Description: A vulnerability exists in Exrick xboot that may lead to information disclosure. The issue affects an unknown part of the component Spring Boot Admin/Spring Actuator and can be initiated remotely...

CVE-2025-8527: Server-Side Request Forgery (SSRF)

A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagger. The manipulation of the argument...

PT-2025-31870 · Exrick +1 · Exrick Xboot +1

Name of the Vulnerable Software and Affected Versions: Exrick xboot versions through 3.3.4 Description: A critical vulnerability exists in Exrick xboot related to the Swagger component. The issue involves server-side request forgery SSRF resulting from the manipulation of the loginUrl argument...