18 matches found
CVE-2026-110612
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...
CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...
EUVD-2026-101240
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...
CVE-2026-110612
The vlife application (versions through 2.0.1 ) is vulnerable to an authentication bypass due to a hardcoded HS256 signing key located in the TokenUtil component. This flaw allows unauthenticated attackers to forge JWTs by injecting superUser=true and arbitrary groupIds claims, granting them supe...
CVE-2025-13266
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
io.github.wwwlike:vlife-boot-starter-web (>=1.0.4, <=1.0.7), io.github.wwwlike:vlife-core (>=1.0.4, <=1.0.7) +2 more potentially affected by CVE-2025-13266 via io.github.wwwlike:vlife-base (>=1.0.4, <=1.0.7)
io.github.wwwlike:vlife-base MAVEN version =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.2, =1.0.7 Source cves: CVE-2025-13266 Source advisory: SNYK:JAVA-IOGITHUBWWWLIKE-14038399...
io.github.wwwlike:vlife-boot-starter-web (1.0.5), io.github.wwwlike:vlife-core (1.0.5) +2 more potentially affected by CVE-2025-13266 via io.github.wwwlike:vlife-base (1.0.5)
io.github.wwwlike:vlife-base MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.github.wwwlike:vlife-base and may be impacted: - io.github.wwwlike:vlife-boot-starter-web 1.0.5 - io.github.wwwlike:vlife-core 1.0.5 -...
vlife-base has Path Traversal vulnerability
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
io.github.wwwlike:vlife-boot-starter-web (1.0.4), io.github.wwwlike:vlife-core (1.0.4) +2 more potentially affected by CVE-2025-13266 via io.github.wwwlike:vlife-base (1.0.4)
io.github.wwwlike:vlife-base MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.github.wwwlike:vlife-base and may be impacted: - io.github.wwwlike:vlife-boot-starter-web 1.0.4 - io.github.wwwlike:vlife-core 1.0.4 -...
GHSA-CG6M-9276-QPJJ vlife-base has Path Traversal vulnerability
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
EUVD-2025-197763
vlife-base has Path Traversal vulnerability...
CVE-2025-13266
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
CVE-2025-13266
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
CVE-2025-13266 wwwlike vlife VLifeApi SysFileApi.java create path traversal
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
CVE-2025-13266 wwwlike vlife VLifeApi SysFileApi.java create path traversal
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
CVE-2025-13266: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to...
PT-2025-47121
Name of the Vulnerable Software and Affected Versions wwwlike vlife versions up to 2.0.1 Description A security issue exists in wwwlike vlife that allows for path traversal. The issue is located in the create function within the vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java file of...
vlife path traversal vulnerability
vlife is a quasi-zero code platform for individual developers of programmer Chao wwwlike. A path traversal vulnerability exists in vlife 2.0.1 and earlier versions. The vulnerability stems from incorrect operation of the parameter fileName in the file...