Vulnerabilidades em Dromara

62 resultados
Análise Vexday

Dromara apresenta 21 vulnerabilidades catalogadas sem exploração ativa registrada, reduzindo o risco imediato de comprometimento. A fraqueza dominante é injeção (CWE-74), padrão em componentes de processamento de dados, com apenas 2 divulgações recentes sugerindo que o risco evoluiu moderadamente. Nenhuma crítica CVSS reduz a urgência operacional, embora a mitigação sistemática da injeção seja recomendada em integrações com dados não-confiáveis.

CVE-2026-107779CRITICALDromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCEEPSS 0.5%CVE-2025-6517MEDIUMDromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgeryEPSS 0.5%CVE-2024-3928MEDIUMDromara open-capacity-platform auth-server heapdump information disclosureEPSS 0.5%CVE-2023-2475LOWDromara J2eeFAST System Message cross site scriptingEPSS 0.5%CVE-2023-2476LOWDromara J2eeFAST Announcement cross site scriptingEPSS 0.5%CVE-2026-90510MEDIUMdromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keyEPSS 0.5%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.5%CVE-2026-91996HIGHlamp-cloud through 5.10.0 Missing Authentication for JVM Properties EndpointEPSS 0.5%CVE-2026-94534HIGHlamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpointsEPSS 0.5%CVE-2026-94535HIGHlamp-cloud through 5.10.0 Unauthorized Notification DeletionEPSS 0.5%CVE-2026-110609HIGHDromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword ParameterEPSS 0.5%CVE-2026-94532HIGHlamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoByIdEPSS 0.4%CVE-2026-94533HIGHlamp-cloud through 5.10.0 Unauthorized File Download via /anyone/fileEPSS 0.4%CVE-2026-19756MEDIUMDromara lamp-cloud Code Generator DefGenProjectController.java path traversalEPSS 0.4%CVE-2026-78140MEDIUMDromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineEPSS 0.4%CVE-2026-92992MEDIUMDromara mayfly-go AI Assistant ai.go authorizationEPSS 0.4%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.4%CVE-2026-120461HIGHJpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batchEPSS 0.4%CVE-2026-120460HIGHJpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker ControllersEPSS 0.4%CVE-2026-121552MEDIUMdomain-admin before 1.6.79 Missing Authorization via getGroupUserListEPSS 0.4%