Vulnerabilities

TI-2024-30844 CVE-2024-45944 · GHSA-555v-hq3c-8hp4

In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to…

HIGH 82

In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00869 Published 2024-10-18 No fix listed

TI-2024-23198 CVE-2024-35091 · GHSA-8cgc-3vjh-qxp8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

MEDIUM 49

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2024-05-23 No fix listed CWE-89

TI-2024-23196 CVE-2024-35086 · GHSA-rfmp-947p-v557

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

MEDIUM 44

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2024-05-23 No fix listed CWE-89

TI-2024-23192 CVE-2024-35082 · GHSA-mff4-qr3q-573w

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

LOW 28

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00254 Published 2024-05-23 No fix listed CWE-89

TI-2024-23194 CVE-2024-35084 · GHSA-hc62-cr99-v89f

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

MEDIUM 49

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2024-05-23 No fix listed CWE-89

TI-2024-23195 CVE-2024-35085 · GHSA-9phc-8693-5w9q

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

LOW 24

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00245 Published 2024-05-23 No fix listed CWE-89

TI-2024-23197 CVE-2024-35090 · GHSA-65j3-jmpw-4gqx

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

MEDIUM 44

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00321 Published 2024-05-23 No fix listed CWE-89

TI-2024-23193 CVE-2024-35083 · GHSA-p27m-65px-rm92

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage…

LOW 38

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00405 Published 2024-05-23 No fix listed CWE-89

TI-2024-21959 CVE-2024-33164 · GHSA-6577-mq92-mvr2

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 44

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00569 Published 2024-05-07 No fix listed CWE-89

TI-2024-21958 CVE-2024-33161 · GHSA-7rp2-vcrx-9h2r

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

LOW 24

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00244 Published 2024-05-07 No fix listed CWE-89

TI-2024-21957 CVE-2024-33155 · GHSA-2769-9cr9-9w7h

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 50

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2024-05-07 No fix listed CWE-89

TI-2024-21956 CVE-2024-33153 · GHSA-9f8j-537f-m943

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 50

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2024-05-07 No fix listed CWE-89

TI-2024-21955 CVE-2024-33149 · GHSA-c9f8-5x26-4646

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

LOW 38

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00483 Published 2024-05-07 No fix listed CWE-89

TI-2024-21954 CVE-2024-33148 · GHSA-4wxr-6xmc-853x

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

LOW 32

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0037 Published 2024-05-07 No fix listed CWE-89

TI-2024-21953 CVE-2024-33147 · GHSA-3f6x-6hg4-cr6h

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 41

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00547 Published 2024-05-07 No fix listed CWE-89

TI-2024-21952 CVE-2024-33146 · GHSA-qwgv-36mc-mpx9

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 42

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0052 Published 2024-05-07 No fix listed CWE-89

TI-2024-21951 CVE-2024-33144 · GHSA-fvwh-2fv9-m663

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 41

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00536 Published 2024-05-07 No fix listed CWE-89

TI-2024-21950 CVE-2024-33139 · GHSA-2jjq-jfw3-m48c

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the…

LOW 39

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00514 Published 2024-05-07 No fix listed CWE-89

TI-2023-02325 CVE-2023-2476 · GHSA-x3x8-xf86-qgp5

Dromara J2eeFAST Announcement cross site scripting

LOW 25

A vulnerability was found in Dromara J2eeFAST up to 2.6.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00522 Published 2023-05-02 No fix listed CWE-79

TI-2023-02324 CVE-2023-2475 · GHSA-chvf-r969-g23v

Dromara J2eeFAST System Message cross site scripting

MEDIUM 58

A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00522 Published 2023-05-02 No fix listed CWE-79

TI-2021-09850 CVE-2021-28890 · GHSA-r43c-87rf-4p27

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId…

MEDIUM 45

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, rela…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0134 Published 2021-08-12 No fix listed CWE-89

Vulnerabilities

Filters