Ana10Gy

**Name of the Vulnerable Software and Affected Versions** xianrendzw EasyReport versions prior to 2.0.17.0522 Beta **Description** Improper neutralization of special elements used in a template engine occurs within the SQL Preview Endpoint component. A remote attacker can manipulate the `sqlText` argument in the `execSqlText()` or `previewSqlText()` functions located in the `DesignerController.java` file to execute the attack. **Recommendations** As a temporary workaround, restrict access to the `execSqlText()` and `previewSqlText()` functions in the `DesignerController.java` file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** xianrendzw EasyReport versions prior to 2.0.17.0522 Beta **Description** A remote issue exists within the QueryerFactory component in the `DataSourceController.add()` function of the `DataSourceController.java` file. Manipulating the `queryerClass` argument can lead to permission issues. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `DataSourceController.add()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** yangzongzhuan RuoYi-Vue versions prior to 3.9.3 **Description** A path traversal issue exists in the Common Download Endpoint within the `fileDownload()` and `resourceDownload()` functions of the `CommonController.java` file. A remote attacker can manipulate the `fileName` or `resource` arguments to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `fileDownload()` and `resourceDownload()` functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SPLWare esProc versions prior to 20260507 **Description** An issue exists where performing a manipulation leads to deserialization, which is the process of converting a byte stream back into an object. This occurs within the `ObjectInputStream.readUnshared()` function located in the `src/main/java/com/scudata/parallel/SocketData.java` file, allowing for remote exploitation. **Recommendations** Update to a version released after 20260507. As a temporary workaround, restrict access to the `ObjectInputStream.readUnshared()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** xianrendzw EasyReport versions prior to 2.0.17.0522 Beta **Description** A remote SQL injection exists within the Move Operations component, specifically in the `ModuleController.java` file. The issue occurs when the `sourcePath` argument is manipulated, allowing an attacker to execute arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `sourcePath` argument within the Move Operations component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jishenghua jshERP versions prior to 3.7 **Description** A path traversal issue exists in the 'addAccountHeadAndDetail' endpoint. This occurs within the `addAccountHeadAndDetail()` function located in the `jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java` file. A remote attacker can manipulate the `fileName` argument to access files and directories outside the intended folder. Path traversal is a technique that allows an attacker to read arbitrary files on the server by manipulating file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the 'addAccountHeadAndDetail' endpoint or avoid using the `fileName` parameter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** jishenghua jshERP versions prior to 3.7 **Description** A server-side request forgery (SSRF) exists in the platformConfig Add Endpoint. A remote attacker can manipulate the `platformValue` argument within the `insertPlatformConfig()` function of the `jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java` file to trigger the issue. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `insertPlatformConfig()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** elunez eladmin versions prior to 2.8 **Description** A command injection issue exists within the Application Deployment Module in the `App.java` file. This occurs when the `uploadPath` argument is manipulated, allowing for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jeecgboot versions prior to 3.9.2 **Description** A remote server-side request forgery (SSRF) exists in the Cloud Instance Metadata Endpoint component. The issue occurs within the `FileDownloadUtils.download2DiskFromNet()` function located in the `/airag/app/debug` file, where improper manipulation of processed URLs allows an attacker to induce the server to make unintended requests. **Recommendations** Upgrade to version 3.9.2.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.3 **Description** A server-side request forgery (SSRF) issue exists in an unknown function within the file `/airag/airagModel/test`. This occurs when the `baseUrl` argument is manipulated, allowing a remote attacker to induce the server to make unintended requests. **Recommendations** Update to a version newer than 3.9.2. As a temporary workaround, restrict access to the file `/airag/airagModel/test` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.3 **Description** A server-side request forgery (SSRF) issue exists in the `WordUtil.addImage()` function within the `/airag/word/edit` file. This flaw allows a remote attacker to execute a manipulation that triggers the server to make unauthorized requests. **Recommendations** As a temporary workaround, restrict access to the `WordUtil.addImage()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** jishenghua jshERP versions prior to 3.7 **Description** A server-side request forgery (SSRF) exists in the `updatePlatformConfigByKey` endpoint. This occurs when the `weixinUrl` argument is manipulated within the `getUserByWeixinCode()` function located in the `jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java` file. This flaw allows a remote attacker to induce the server to make unauthorized requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `updatePlatformConfigByKey` endpoint or avoid using the `weixinUrl` parameter.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.1 **Description** Improper authorization exists in the FillRuleUtil Component within the '/sys/fillRule/edit' endpoint. A remote attacker can manipulate the `ruleClass` argument to bypass authorization controls. **Recommendations** Upgrade the affected component to a version containing the fix. As a temporary workaround, restrict access to the '/sys/fillRule/edit' endpoint or avoid using the `ruleClass` argument until the update is applied.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.2 **Description** A server-side request forgery (SSRF) exists in the 'LoadFile' endpoint. The issue occurs within the `checkPathTraversalBatch()` function of the `FileDownloadUtils.jav` file due to improper manipulation of the `files` argument, allowing a remote attacker to initiate the attack. **Recommendations** Upgrade the affected component to a version later than 3.9.1. As a temporary workaround, restrict access to the 'LoadFile' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.2 **Description** An issue in the OpenApi Service component allows remote attackers to perform server-side request forgery (SSRF), a flaw where the server is coerced into making unintended requests. This occurs through the manipulation of the `originUrl` argument within the 'OpenApiController.add' and 'OpenApiController.call' functions of the `OpenApiController.java` file. **Recommendations** Upgrade the affected component to a version that contains the fix. As a temporary workaround, restrict access to the 'OpenApiController.add' and 'OpenApiController.call' functions.

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.2 **Description** A flaw in the `uploadImgByHttpEndpoint` component allows for remote server-side request forgery (SSRF), which occurs when a server is tricked into making unauthorized requests to internal or external resources. This issue affects the functions `CommonController.uploadImgByHttp()`, `HttpFileToMultipartFileUtil.httpFileToMultipartFile()`, and `HttpFileToMultipartFileUtil.downloadImageData()` within the `CommonController.java` file. **Recommendations** Upgrade to the upcoming release containing the fix. As a temporary workaround, restrict access to the `CommonController.uploadImgByHttp()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** 1Panel-dev MaxKB versions prior to 2.5.0 **Description** An issue exists in the MdPreview component within the file 'ui/src/chat.ts'. This flaw allows a remote attacker to perform cross site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. **Recommendations** Upgrade to version 2.5.0.

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1 Description A vulnerability exists in the `execute` function within the file `apps/application/flow/step node/mcp node/impl/base mcp node.py` of the Model Context Protocol Node component. Manipulation of this function can lead to operating system command injection, potentially allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed. Recommendations Upgrade the affected component to a fixed version.

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1 Description A flaw exists in the processing of the file `apps/common/middleware/chat headers middleware.py` within the ChatHeadersMiddleware component. Manipulation of the `Name` argument can lead to cross site scripting. Remote exploitation is possible. Recommendations Upgrade to version 2.8.0 to address this issue.

**Name of the Vulnerable Software and Affected Versions** 1Panel-dev MaxKB versions up to 2.2.1 **Description** A cross-site scripting issue exists due to the manipulation of the `Name` argument within the `StaticHeadersMiddleware` function located in the `apps/common/middleware/static headers middleware.py` file of the Public Chat Interface component. The attack can be launched remotely. **Recommendations** Upgrade to version 2.8.0.