Vulnerabilities

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function.

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions.

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments.

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events.

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2.

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2.

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2.

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical.