Priority MEDIUM 56
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00398 · Published 2026-10-16 · No fix listed CWE-639
Priority MEDIUM 57
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00193 · Published 2026-10-11 · No fix listed CWE-862
Priority MEDIUM 57
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00208 · Published 2026-10-11 · No fix listed CWE-862
Priority MEDIUM 57
A vulnerability was found in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00366 · Published 2026-08-20 · No fix listed CWE-266
Priority MEDIUM 57
A weakness has been identified in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.01173 · Published 2026-06-02 · No fix listed CWE-74
Priority HIGH 70
A vulnerability has been discovered in eladmin v2.7 and before.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00207 · Published 2026-02-04 · No fix listed CWE-284
Priority MEDIUM 57
A vulnerability was identified in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00293 · Published 2025-09-08 · No fix listed CWE-266
Priority MEDIUM 45
A flaw has been found in elunez eladmin up to 2.7.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00296 · Published 2025-09-05 · No fix listed CWE-266
Priority MEDIUM 57
A security flaw has been discovered in elunez eladmin 1.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2025-09-03 · No fix listed CWE-266
Priority MEDIUM 57
A weakness has been identified in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00332 · Published 2025-08-20 · No fix listed CWE-1236
Priority LOW 24
A security flaw has been discovered in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00344 · Published 2025-08-20 · No fix listed CWE-200
Priority LOW 27
A vulnerability was identified in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00201 · Published 2025-08-20 · No fix listed CWE-310
Priority HIGH 70
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00554 · Published 2025-08-04 · No fix listed CWE-1392
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00502 · Published 2025-04-04 · No fix listed CWE-20
Priority MEDIUM 56
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00554 · Published 2025-03-27 · No fix listed CWE-20
Priority HIGH 82
eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00557 · Published 2025-02-03 · No fix listed CWE-74
Priority HIGH 67
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00955 · Published 2024-10-30 · No fix listed CWE-94
Priority MEDIUM 64
A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00425 · Published 2024-10-30 · No fix listed CWE-918
Priority MEDIUM 49
eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00497 · Published 2024-09-10 · No fix listed CWE-352
Priority MEDIUM 60
eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.005 · Published 2024-09-10 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was found in elunez eladmin up to 2.7 and classified as critical.
CVSS 4.0MEDIUM 5.1· Adjacent network · Low privileges · No interaction · EPSS 0.00839 · Published 2024-08-04 · No fix listed CWE-27
THREATIST.IORead the docs