Priority MEDIUM 49
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00544 · Published 2026-10-31 · No fix listed CWE-321
Priority HIGH 82
anji-plus AJ-Report is affected by an authentication bypass vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.5175 · Published 2024-08-02 · Fixed in 1.4.1 CWE-288
Priority LOW 26
A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.01026 · Published 2024-05-26 · No fix listed CWE-89
Priority MEDIUM 59
A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.03182 · Published 2024-05-26 · No fix listed CWE-77
Priority LOW 25
A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00628 · Published 2024-05-26 · No fix listed CWE-200
Priority MEDIUM 57
A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00802 · Published 2024-05-26 · No fix listed CWE-22
Priority LOW 25
A vulnerability was found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00769 · Published 2024-05-26 · No fix listed CWE-502
Priority LOW 25
A vulnerability was found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00769 · Published 2024-05-26 · No fix listed CWE-502
Priority LOW 25
A vulnerability was found in anji-plus AJ-Report up to 1.4.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00597 · Published 2024-05-25 · No fix listed CWE-89
Priority MEDIUM 44
Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00833 · Published 2023-03-03 · No fix listed CWE-918
Priority MEDIUM 44
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01739 · Published 2022-10-17 · No fix listed CWE-290
THREATIST.IORead the docs