EUVD-2026-96580

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

CVE-2026-108641

The JeecgBoot framework, version through 3.9.5 , is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the SysAnnouncementSendController component. Specifically, the getOne handler fails to properly authorize requests, allowing authenticated users to access messages belongi...

PHPMyWind某处设计失误导致7-8处SQL注入

简要描述： PHPMyWind某处设计失误导致7-8处SQL注入 详细说明： 经过简单审核发现phpmywind的一个漏洞集群，其实是设计原因导致的，总共会导致8处SQL注入，涉及的文件有两个分别是order.php 和 orderenter.php。漏洞核心在于$orderinfo在传输值的时候没有经过SQL注入的过滤。详述如下： 首先进入order.php，该页面用于填写商品订单信息，这里就生成了一个$orderinfo这个变量。 if$action == 'save' //检测数据完整性 if$username == '' or $truename == '' or...