EUVD-2026-52663

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

Eclipse Milo 1.0.0–1.1.4 contains a bug in OpcUaServerConfig.copy() that fails to preserve a configured RoleMapper. On servers building running config via copy(), sessions may have no role IDs, causing the default access controller to skip role-permission checks. This enables an anonymous client ...

PT-2026-67695

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4 Description The OpcUaServerConfig.copy function fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration using copy, sessions are not...

CVE-2026-58080: Missing Authorization

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

CVE-2023-24220

LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml...

LuckyFrame SQL injection vulnerability

LuckyFrame is a free and open source testing platform. A security vulnerability exists in LuckyFrame v3.5, which originates from a SQL injection vulnerability in the dataScope parameter in /system/RoleMapper.xml...