CVE-2026-108869

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108868

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability (CWE-862) accessible via the POST /sys/api/sendBusTemplateAnnouncement endpoint. This flaw allows any authenticated user to publish templated system announcements. A low-privileged attacker can provide specific...

EUVD-2026-97043

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

PT-2026-110191

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can send forged system announcements to any user via WebSocket, WeCom, DingTalk, and Feishu. This is possible by calling the POST '/sys/api/sendSysAnnouncement'...

CVE-2026-108869: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

EUVD-2018-2441

Malware in sbrugna...

EUVD-2023-36090

Malicious code in bioql PyPI...

CVE-2023-31799

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter...

CVE-2023-31799

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter...

CVE-2023-31799

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter...

CVE-2023-31799: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-08584)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in the system announcement feature of the extension module in WUZHI CMS version 4.1.0. A remote attacker can exploit th...