Feng123123

**Name of the Vulnerable Software and Affected Versions** JeecgBoot version 3.9.1 **Description** An improper authentication issue exists in the OpenAPI Endpoint component due to the processing of the '/openapi/call/' endpoint. This flaw allows for remote execution, although it is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yangzongzhuan RuoYi-Vue versions prior to 3.9.3 **Description** A flaw in the Common Upload Endpoint component allows for unrestricted file upload. This issue occurs within the `FileUploadUtils.upload()` function located in the '/common/upload' endpoint and can be exploited remotely through manipulation. **Recommendations** Update to a version later than 3.9.2. As a temporary workaround, restrict access to the '/common/upload' endpoint or disable the `FileUploadUtils.upload()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** JPress versions prior to 1.0.4 **Description** An improper authorization issue exists in the UCenter Article Submission Endpoint within the file '/ucenter/article/doWriteSave'. A remote attacker can manipulate the `id`/`userId` arguments to bypass authorization controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/ucenter/article/doWriteSave' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dromara RuoYi-Vue-Plus versions through 5.5.3 **Description** A missing authorization issue exists in the Workflow Module of Dromara RuoYi-Vue-Plus. The issue affects the `SaServletFilter` function within the `/workflow/instance/deleteByInstanceIds` file. This allows for remote exploitation due to a lack of proper authorization checks. The exploit is publicly available. **Recommendations** Update to a version beyond 5.5.3. As a temporary workaround, restrict access to the `/workflow/instance/deleteByInstanceIds` file and the `SaServletFilter` function.