elunez

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

elunez records in CISA KEV

No elunez vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Eladmin 15 records HIGH

Records

21 records

TI-2025-16810 CVE-2025-22978 · GHSA-gf66-v569-23vx

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.

HIGH 82

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2025-02-03 No fix listed CWE-74

TI-2025-43187 CVE-2025-70997 · GHSA-pc84-8mjq-pcg8

A vulnerability has been discovered in eladmin v2.7 and before.

HIGH 70

A vulnerability has been discovered in eladmin v2.7 and before.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00207 Published 2026-02-04 No fix listed CWE-284

TI-2025-07810 CVE-2025-8530 · GHSA-xm33-6wj2-8hph

elunez eladmin Druid application-prod.yml default credentials

HIGH 70

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2025-08-04 No fix listed CWE-1392

TI-2024-34293 CVE-2024-51243 · GHSA-f7rc-79mv-v26v

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can…

HIGH 67

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00955 Published 2024-10-30 No fix listed CWE-94

TI-2024-34292 CVE-2024-51242 · GHSA-84c3-765r-7fjp

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and…

MEDIUM 64

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00425 Published 2024-10-30 No fix listed CWE-918

TI-2024-29956 CVE-2024-44676 · GHSA-8vw5-3vcf-59wh

eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an…

MEDIUM 60

eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.005 Published 2024-09-10 No fix listed CWE-79

TI-2026-70686 CVE-2026-108706 · GHSA-8j2c-pwgm-76r5

Missing authorization in eladmin S3 storage download endpoint

MEDIUM 57

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-11 No fix listed CWE-862

TI-2026-70668 CVE-2026-108688 · GHSA-2hch-3q25-w3g9

Missing authorization in Eladmin lets users write files to server storage

MEDIUM 57

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00208 Published 2026-10-11 No fix listed CWE-862

TI-2026-53815 CVE-2026-77036 · GHSA-782r-wf8m-ggvv

elunez eladmin GenConfigController improper authorization

MEDIUM 57

A vulnerability was found in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-08-20 No fix listed CWE-266

TI-2026-09075 CVE-2026-10550 · GHSA-2rwm-2h4j-cr72

elunez eladmin Application Deployment App.java command injection

MEDIUM 57

A weakness has been identified in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01173 Published 2026-06-02 No fix listed CWE-74

TI-2025-09257 CVE-2025-10084 · GHSA-mm3p-cjh3-hc74

elunez eladmin SysLogController 1 queryErrorLogDetail improper authorization

MEDIUM 57

A vulnerability was identified in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00293 Published 2025-09-08 No fix listed CWE-266

TI-2025-09118 CVE-2025-9937 · GHSA-8wjx-fw8f-7fvv

elunez eladmin LocalStorageController deleteFile improper authorization

MEDIUM 57

A security flaw has been discovered in elunez eladmin 1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00393 Published 2025-09-03 No fix listed CWE-266

TI-2025-08473 CVE-2025-9241 · GHSA-3v6h-4jjq-8c6c

elunez eladmin exportUser csv injection

MEDIUM 57

A weakness has been identified in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00332 Published 2025-08-20 No fix listed CWE-1236

TI-2025-02847 CVE-2025-3250 · GHSA-fc2p-qppw-qq2v

elunez eladmin Maintenance Management Module testConnect deserialization

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00502 Published 2025-04-04 No fix listed CWE-20

TI-2026-75390 CVE-2026-111604 · GHSA-7qp5-57jr-xmpr

Authorization bypass in eladmin exposes users in other departments

MEDIUM 56

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00398 Published 2026-10-16 No fix listed CWE-639

TI-2025-02493 CVE-2025-2855 · GHSA-wq76-hwvv-4gwx

elunez eladmin upload checkFile deserialization

MEDIUM 56

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00554 Published 2025-03-27 No fix listed CWE-20

TI-2024-06912 CVE-2024-7458 · GHSA-cccm-3vq5-cxqg

elunez eladmin Database Management/Deployment Management upload path traversal

MEDIUM 56

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical.

CVSS 4.0MEDIUM 5.1 Adjacent network Low privileges No interaction EPSS 0.00839 Published 2024-08-04 No fix listed CWE-27

TI-2024-29957 CVE-2024-44677 · GHSA-38rg-8rfh-j366

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows…

MEDIUM 49

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00497 Published 2024-09-10 No fix listed CWE-352

TI-2025-09192 CVE-2025-10014 · GHSA-837q-78w5-p6p8

elunez eladmin Email Address updateEmail updateUserEmail improper authorization

MEDIUM 45

A flaw has been found in elunez eladmin up to 2.7.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00296 Published 2025-09-05 No fix listed CWE-266

TI-2025-08471 CVE-2025-9239 · GHSA-h7vx-m3wc-6xq4

elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

LOW 27

A vulnerability was identified in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00201 Published 2025-08-20 No fix listed CWE-310

TI-2025-08472 CVE-2025-9240 · GHSA-4gj3-28pw-jmff

elunez eladmin info information disclosure

LOW 24

A security flaw has been discovered in elunez eladmin up to 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00344 Published 2025-08-20 No fix listed CWE-200

Open these records in search →