CVE-2026-72823

The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...

CVE-2026-3028

A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely...

PT-2024-13738 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: JEECG versions 4.0 and earlier Description: The issue allows attackers to run arbitrary code via a crafted POST request due to deserialization of untrusted data in the jeecgFormDemoController. This can be exploited by sending a malicious POST...