Vulnerabilities in Dromara

48 results
Vexday analysis

Dromara apresenta 21 vulnerabilidades catalogadas sem exploração ativa registrada, reduzindo o risco imediato de comprometimento. A fraqueza dominante é injeção (CWE-74), padrão em componentes de processamento de dados, com apenas 2 divulgações recentes sugerindo que o risco evoluiu moderadamente. Nenhuma crítica CVSS reduz a urgência operacional, embora a mitigação sistemática da injeção seja recomendada em integrações com dados não-confiáveis.

CVE-2024-12483MEDIUMDromara UJCMS User ID id authorizationEPSS 3.6%CVE-2026-92993MEDIUMDromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injectionEPSS 2.6%CVE-2023-51653CRITICALHertzbeat JMX JNDI RCEEPSS 2.1%CVE-2023-51387HIGHExpression Injection Vulnerability in HertzbeatEPSS 1.4%CVE-2023-51388CRITICALHertzBeat AviatorScript Inject RCEEPSS 1.3%CVE-2023-51389CRITICALHertzBeat SnakeYAML Deser RCEEPSS 1.3%CVE-2022-39337HIGHPermission bypass due to incorrect configuration in github.com/dromara/hertzbeatEPSS 1.1%CVE-2026-69100HIGHLAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code ExecutionEPSS 1.0%CVE-2026-2953MEDIUMDromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversalEPSS 1.0%CVE-2025-6925MEDIUMDromara RuoYi-Vue-Plus Mail MailController.java path traversalEPSS 1.0%CVE-2022-4565MEDIUMDromara HuTool cn.hutool.core.util.ZipUtil.java resource consumptionEPSS 0.9%CVE-2023-51650HIGHUnauthorized access vulnerability on three interfacesEPSS 0.9%CVE-2023-3276MEDIUMDromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceEPSS 0.7%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.7%CVE-2026-69102CRITICALMaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trustEPSS 0.6%CVE-2026-19757MEDIUMDromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversalEPSS 0.6%CVE-2026-19758MEDIUMdromara lamp-cloud chunk-check endpoint FileChunkController.java path traversalEPSS 0.6%CVE-2026-93961MEDIUMDromara UJCMS UserController UserController.java usernameExist improper authorizationEPSS 0.6%CVE-2026-67345HIGHMaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code TheftEPSS 0.6%CVE-2025-6517MEDIUMDromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgeryEPSS 0.5%