EUVD-2026-84044

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-94151

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2026-94149

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94151 Omega Solution HRM OS Role Permission API permission missing authentication

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2026-94151

A missing authentication vulnerability in Omega Solution HRM OS (up to version 20260717 ) affects the Role Permission API at the endpoint /role-permission/permission. Manipulating the roleId argument allows an unauthenticated remote attacker to bypass authentication controls, resulting in a low c...

EUVD-2026-83864

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2026-94151 Omega Solution HRM OS Role Permission API permission missing authentication

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149

Omega Solution HRM OS (versions up to 20260717) is affected by an improper control of resource identifiers flaw in the Role Permission Retrieval Endpoint at /role-permission/permission. Manipulating the roleId argument allows a remote, authenticated attacker (low privileges) to access permission ...

EUVD-2026-83859

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149: Improper Control of Resource Identifiers

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

PT-2026-96206

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization check is missing on the 'POST /userBusiness/updateBtnStr' endpoint, allowing authenticated users to modify role button-permission definitions. An attacker can provide arbitrary roleId a...

PT-2026-96054

Name of the Vulnerable Software and Affected Versions Omega Solution HRM OS versions prior to 20260718 Description A weakness in the Role Permission API component allows remote attackers to bypass authentication. This occurs through the manipulation of the roleId argument within the...

CVE-2026-94151: Missing Authentication for Critical Function

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2025-15122

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is...

EUVD-2025-205495

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is...

CVE-2025-15122

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is...

CVE-2025-15122 JeecgBoot datarule loadDatarule improper authorization

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is...