CVE-2025-7938mediumCWE-285 CWE-639

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%

probabilidad de explotación

0.4%top 69% de las CVE

explotación observada

noninguna fuente lo reporta

A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Productos afectados

jerryshensjf · JPACookieShop 蛋糕商城JPA版

Referencias

https://github.com/Bemcliu/cve-reports/blob/main/cve-02-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Privilege%20Escalation/readme.md https://vuldb.com/?ctiid.317075 https://vuldb.com/?id.317075 https://vuldb.com/?submit.618985