Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 18, 2024In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code executCVE-2024-45944 · Other software · j2eefast · reported by MITRECritical 9.8
In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.CVE-2024-35091 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.CVE-2024-35090 · Other software · j2eefast · reported by MITREHigh 8.2
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .CVE-2024-35086 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.CVE-2024-35085 · Other software · j2eefast · reported by MITREMedium 5.4
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.CVE-2024-35084 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.CVE-2024-35083 · Other software · j2eefast · reported by MITREHigh 8.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 23, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.CVE-2024-35082 · Other software · J2eefast · reported by MITREMedium 6.3
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.
- Product
- J2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comj2eefast.com
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function.CVE-2024-33164 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function.CVE-2024-33161 · Other software · j2eefast · reported by MITREMedium 5.3
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.CVE-2024-33155 · Other software · j2eefast · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.CVE-2024-33153 · Other software · dromara · reported by MITRECritical 9.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function.CVE-2024-33149 · Other software · j2eefast · reported by MITREHigh 8.1
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function.CVE-2024-33148 · Other software · J2eefast · reported by MITREHigh 7.3
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function.
- Product
- J2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function.CVE-2024-33147 · Other software · j2eefast · reported by MITREHigh 8.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.CVE-2024-33146 · Other software · j2eefast · reported by MITRECritical 9.1
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.CVE-2024-33144 · Other software · j2eefast · reported by MITREHigh 8.8
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function.CVE-2024-33139 · Other software · j2eefast · reported by MITREHigh 7.5
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023A vulnerability was found in Dromara J2eeFAST up to 2.6.0.CVE-2023-2476 · Other software · Dromara · reported by VulDBLow 3.5
A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-227868.
- Product
- J2eeFAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic.CVE-2023-2475 · Other software · Dromara · reported by VulDBLow 3.5
A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-227867.
- Product
- J2eeFAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, CVE-2021-28890 · Other software · J2eefast · reported by MITRECritical 9.8
J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, related to the use of ${} to join SQL statements.
- Product
- J2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.