CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to...

CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108612

The JeecgBoot application, versions through 3.9.5 , is affected by a missing authorization vulnerability in the AigcWordTemplateController 's deleteBatch handler. This flaw allows low-privileged authenticated users to perform unauthorized actions by sending a DELETE request to the /airag/word/del...

CVE-2026-108611

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the AigcWordTemplateController delete handler. This vulnerability allows any authenticated user to perform unauthorized actions by sending DELETE requests to the /airag/word/delete endpoint. By providing an id ...

CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove a...

CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove a...

CVE-2026-108610

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the AigcWordTemplateController edit handler. This vulnerability allows any authenticated user to perform unauthorized modifications to word templates. Specifically, low-privileged attackers can exploit this by ...

CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other...

CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other...

CVE-2026-108606

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the AiOcrController deleteById handler. This allows any authenticated user to delete OCR records. An attacker with low privileges can first retrieve record IDs from the unguarded GET /airag/ocr/list endpoint and...

CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

CVE-2026-108605

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability in the AiOcrController updateById handler. This flaw allows any authenticated user to send PUT requests to the /airag/ocr/edit endpoint. An attacker can exploit this to overwrite LLM prompts in the shared air...

CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

CVE-2026-103685

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

EUVD-2026-96431

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

CVE-2026-103357

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

EUVD-2026-96378

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...