Threats affecting pkg:github/elunez/eladmin

ELADMIN version 2.7 and earlier contains a Cross Site Scripting (XSS) vulnerability in the WebSocketServer, SpringSecurityConfig, and deploy.vue components. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-77036 is a medium severity vulnerability in elunez eladmin up to version 2.7. It involves improper authorization in several controller functions (EmailController, AliPayController, GeneratorController, GenConfigController). The vulnerability allows remote attackers to exploit authorization weaknesses. The issue was reported early to the project, but no response or fix has been provided yet. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been confirmed.

CVE-2026-10550 is a command injection vulnerability in elunez eladmin affecting versions 2.0 through 2.7. The issue arises from unsafe manipulation of the uploadPath argument in the Application Deployment Module's App.java file. This flaw allows remote attackers to execute arbitrary commands. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation has been announced by the vendor as of the publication date.

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.