Threats tagged 'ghsa-w672-5jg3-397x'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.9	EPSS 0.3%	CVE-2026-100192yzcheng90 X-SpringBoot · Missing Authentication Medium6.9EPSS 0.3%2026-09-25CVE Database V5CVE-2026-100192 X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks. EPSS 0.3%Vulnerability #ghsa-w672-5jg3-397x	CVE Database V5	2026-09-25

Page 1 of 1