CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-72823

The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...

CVE-2026-3028

A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely...

PT-2024-13738 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: JEECG versions 4.0 and earlier Description: The issue allows attackers to run arbitrary code via a crafted POST request due to deserialization of untrusted data in the jeecgFormDemoController. This can be exploited by sending a malicious POST...