Jpom versions up to 2.11.12 have an authorization bypass vulnerability in the SshFileController. Authenticated users with SSH file permissions in any workspace can exploit this flaw by supplying foreign SSH asset IDs, allowing them to access SSH hosts of other workspaces. This enables unauthorized reading, modification, and deletion of files across workspaces via multiple endpoints.
CVE-2026-110609 is a SQL injection vulnerability in Dromara Skyeye that affects version 0. It allows authenticated users with low privileges to inject SQL commands via the keyword parameter in certain MyBatis queries. This can lead to unauthorized data extraction, including data from other tenants. The vulnerability is rated high severity with a CVSS score of 7.1.
CVE-2026-110107 is an authorization bypass vulnerability in dromara RuoYi-Cloud-Plus versions up to 6.0.0. Authenticated users can delete other users' social login bindings by supplying their socialId in a DELETE request. This allows removal of victims' OAuth tokens and blocks their social login access. The vulnerability arises from lack of ownership checks when deleting sys_social rows by primary key.
RuoYi-Vue-Plus versions up to 6.0.0 contain an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by specifying their socialId. This can remove GitHub, WeChat, or Gitee bindings and stored OAuth tokens, effectively blocking social login for the targeted user. The vulnerability requires authentication and has a low severity score.
lamp-cloud versions up to 5.10.1 have an insecure direct object reference vulnerability that allows authenticated users to access file attachments of other business objects by manipulating the bizId parameter. This exposure reveals file names, storage paths, MD5 hashes, and stored URLs. In default LOCAL storage configurations, these files can be accessed without authentication via the /anyTenant/file path.
lamp-cloud versions up to 5.10.1 contain an authorization bypass vulnerability where authenticated users can access storage URLs of other users' files by providing arbitrary file IDs. The vulnerability exists because the findUrlById handler in FileAnyoneController does not verify file ownership before returning access URLs, allowing unauthorized file access.
CVE-2026-107781 is a critical server-side request forgery (SSRF) and missing authorization vulnerability in Dromara Skyeye's OnlyOffice save callback function editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary URL and key parameters to cause the server to fetch internal URLs and overwrite any user's stored file, then read the results via another function. This vulnerability allows unauthorized file manipulation and data exposure.
Dromara Skyeye version 0 contains a critical OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint. The flaw allows attackers to inject a single quote into the format parameter, breaking out of the PowerShell string and executing arbitrary commands with the privileges of the Skyeye service account on Windows systems.
Dromara Skyeye version 0 contains a critical missing authentication vulnerability in certain job management endpoints. Unauthenticated attackers can submit jobs with malicious code to the /jobinfo/addAndStart endpoint, leading to remote command execution or job disruption on the executor host. This vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact without requiring any privileges or user interaction.
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.
lamp-cloud versions up to and including 5.10.0 have an authorization bypass vulnerability in the deleteMyNotice endpoint. Authenticated users can delete notifications belonging to other users by calling the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs. This occurs due to lack of recipient validation, allowing unauthorized deletion of notifications.
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
lamp-cloud versions up to 5.10.0 contain an authorization bypass vulnerability in the FileAnyoneController component. Authenticated users can download arbitrary attachments belonging to other users by supplying valid attachment IDs to specific endpoints, due to lack of ownership validation. This vulnerability allows unauthorized access to stored files without requiring elevated privileges.
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.
CVE-2026-93961 is an improper authorization vulnerability in Dromara UJCMS affecting versions 12.3.0 and 12.3.1. The flaw exists in the usernameExist function of the UserController component, allowing remote attackers to manipulate the Username argument to bypass authorization controls. The issue was reported early to the project but has not yet received a response or fix.
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The identifier of the patch is 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. Applying a patch is the recommended action to fix this issue. The whitelist bypass is one-token wide. Any compound command containing curl, wget or sed auto-runs without approval; approval is granted by the same session user (self-approval). This issue got fixed with a silent patch.
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository existence, determine repository type, and execute git ls-remote commands using other workspaces' stored credentials.
A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key
. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.