Vulnerabilidades em dromara
48 resultadosAnálise Vexday
Dromara apresenta um portfólio reduzido de 7 vulnerabilidades, com 3 classificadas como críticas, mas nenhuma sob exploração ativa conhecida no momento. A fraqueza dominante é CWE-74 (improper neutralization of special elements), representando um padrão de validação inadequada; apenas 1 vulnerabilidade foi publicada nos últimos 90 dias, indicando risco estável e não uma tendência de descobertas crescentes.
CVE-2026-19757MEDIUMDromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversalEPSS 0.4%CVE-2026-93961MEDIUMDromara UJCMS UserController UserController.java usernameExist improper authorizationEPSS 0.4%CVE-2026-91996HIGHlamp-cloud through 5.10.0 Missing Authentication for JVM Properties EndpointEPSS 0.4%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.3%CVE-2025-2491MEDIUMDromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingEPSS 0.3%CVE-2025-15117LOWDromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserializationEPSS 0.3%CVE-2025-2490MEDIUMDromara ujcms File Upload WebFileUploadController.java upload cross site scriptingEPSS 0.3%CVE-2026-67345HIGHMaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code TheftEPSS 0.3%CVE-2026-6125MEDIUMDromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionEPSS 0.3%CVE-2026-9498MEDIUMDromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engineEPSS 0.3%CVE-2026-90510MEDIUMdromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keyEPSS 0.3%CVE-2025-7552MEDIUMDromara Northstar Path AuthorizationInterceptor.java preHandle access controlEPSS 0.3%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.3%CVE-2026-19756MEDIUMDromara lamp-cloud Code Generator DefGenProjectController.java path traversalEPSS 0.3%CVE-2026-92992MEDIUMDromara mayfly-go AI Assistant ai.go authorizationEPSS 0.3%CVE-2026-5529MEDIUMDromara lamp-cloud DefUserController pageUser improper authorizationEPSS 0.3%CVE-2025-13268MEDIUMDromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injectionEPSS 0.3%CVE-2026-94534HIGHlamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpointsEPSS 0.3%CVE-2026-2819MEDIUMDromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorizationEPSS 0.3%CVE-2026-94535HIGHlamp-cloud through 5.10.0 Unauthorized Notification DeletionEPSS 0.3%