Vulnerabilidades em Dromara
48 resultadosAnálise Vexday
Dromara apresenta 21 vulnerabilidades catalogadas sem exploração ativa registrada, reduzindo o risco imediato de comprometimento. A fraqueza dominante é injeção (CWE-74), padrão em componentes de processamento de dados, com apenas 2 divulgações recentes sugerindo que o risco evoluiu moderadamente. Nenhuma crítica CVSS reduz a urgência operacional, embora a mitigação sistemática da injeção seja recomendada em integrações com dados não-confiáveis.
CVE-2024-3928MEDIUMDromara open-capacity-platform auth-server heapdump information disclosureEPSS 0.5%CVE-2023-2476LOWDromara J2eeFAST Announcement cross site scriptingEPSS 0.5%CVE-2023-2475LOWDromara J2eeFAST System Message cross site scriptingEPSS 0.5%CVE-2026-90510MEDIUMdromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keyEPSS 0.5%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.5%CVE-2026-91996HIGHlamp-cloud through 5.10.0 Missing Authentication for JVM Properties EndpointEPSS 0.5%CVE-2026-94534HIGHlamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpointsEPSS 0.5%CVE-2026-94535HIGHlamp-cloud through 5.10.0 Unauthorized Notification DeletionEPSS 0.5%CVE-2026-58176HIGHRuoYi-Vue-Plus - Missing Authorization on Workflow Task Management EndpointsEPSS 0.5%CVE-2026-94532HIGHlamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoByIdEPSS 0.4%CVE-2026-94533HIGHlamp-cloud through 5.10.0 Unauthorized File Download via /anyone/fileEPSS 0.4%CVE-2026-19756MEDIUMDromara lamp-cloud Code Generator DefGenProjectController.java path traversalEPSS 0.4%CVE-2026-78140MEDIUMDromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineEPSS 0.4%CVE-2026-9498MEDIUMDromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engineEPSS 0.4%CVE-2026-92992MEDIUMDromara mayfly-go AI Assistant ai.go authorizationEPSS 0.4%CVE-2026-6125MEDIUMDromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionEPSS 0.4%CVE-2026-2819MEDIUMDromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorizationEPSS 0.3%CVE-2026-5529MEDIUMDromara lamp-cloud DefUserController pageUser improper authorizationEPSS 0.3%CVE-2026-77795MEDIUMDromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorizationEPSS 0.3%CVE-2026-94536MEDIUMlamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resourceEPSS 0.3%