Threats affecting pkg:maven/com.anjiplus/aj-report

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.3	CVE-2026-120209anji-plus AJ-Report · Use of Hard-coded Cryptographic Key Critical9.32026-10-31CVE Database V5CVE-2026-120209 AJ-Report versions up to 1.7.1 use a hard-coded JWT secret to sign share tokens, enabling attackers to forge valid tokens offline. This allows unauthorized access to the testTransform endpoint, which can execute arbitrary code via GroovyClassLoader without authentication. Vulnerability	CVE Database V5	2026-10-31

Page 1 of 1