EUVD-2026-98888

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords...

CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords...

PT-2026-111715

Name of the Vulnerable Software and Affected Versions Makunet maku-boot versions 4.3.0 through 5.0.0 Description Authenticated users can access mail and SMS configurations due to missing authorization checks. By calling the endpoints '/sys/mail/config/list' and '/sys/sms/config/list', attackers c...

PT-2026-110207

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys sms row, erasing records of sen...

CVE-2025-10822

A vulnerability has been found in fuyanglipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed to the public and m...