6 matches found
CVE-2026-120201
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...
CVE-2026-120201
Jpom versions 2.10.0 through 2.11.12 are vulnerable to an authentication bypass that allows unauthenticated attackers to obtain super-administrator access . The root cause is the improper neutralization of special elements in data query logic (CWE-943); specifically, attackers can inject query co...
EUVD-2026-114722
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...
CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...
CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...
CVE-2026-120201: dromara Jpom: Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...