CVE-2026-97721: fallo de gravedad media en Sanluan PublicCMS
Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.1epss 0.2%
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Sanluan · PublicCMSPoCs públicas encontradas — 1
cve_referencegithub.com/aibot88/CVERequest/blob/main/PublicCMS/issue7.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Sanluan PublicCMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-3289MEDIUMSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalEPSS 0.8%CVE-2026-1111MEDIUMSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalEPSS 0.7%CVE-2026-1112MEDIUMSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationEPSS 0.4%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2024-11070MEDIUMSanluan PublicCMS Tag Type save cross site scriptingEPSS 0.4%CVE-2025-7953MEDIUMSanluan PublicCMS viewer.html redirectEPSS 0.4%