Jinguo Yang

An issue in Erick xmall allows a remote attacker to escalate privileges via the `updateAddress` method of the `Address Controller` class.

The issue allows a remote attacker to escalate privileges via the `jobId` parameter.

The issue allows a remote attacker to escalate privileges via the `editSave` method, which does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings.

The issue allows a remote attacker to escalate privileges via the `changeStatus` method.

The issue allows a remote attacker to escalate privileges via the `jobLogId` parameter.

The issue allows a remote attacker to escalate privileges via the `postID` parameter in the `edit` method.

The issue allows a remote attacker to escalate privileges. This is achieved via the `selectDeptTree` method of the "/selectDeptTree/{deptId}" endpoint, which does not properly validate the `deptId` parameter.

The issue allows a remote attacker to escalate privileges via the `editSave` method in the "/tool/gen/editSave" API endpoint.

The issue allows a remote attacker to escalate privileges via the "API Endpoint: /editSave" method in `SysNoticeController`.

The issue allows a remote attacker to escalate privileges via the SysDictTypeController component.

The issue allows a remote attacker to escalate privileges via the edit method of the "/edit/{dictId}" endpoint, which does not properly validate whether the requesting user has permission to modify the specified `dictId`.