Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: yzcheng90 Clear all filters
TI-2026-63938 CVE-2026-97063 · GHSA-vff2-49vx-fx6p

X-SpringBoot through 6.0 Authentication Bypass via Login Code

Priority HIGH 81

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00292 Published 2026-09-25 No fix listed CWE-287
TI-2026-63935 CVE-2026-97060 · GHSA-7mx4-r2xx-g859

X-SpringBoot through 6.0 Authorization Bypass via User Management

Priority HIGH 72

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00314 Published 2026-09-25 No fix listed CWE-639
TI-2025-35206 CVE-2025-55948 · GHSA-2w5f-22g3-8h49

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation…

Priority HIGH 67

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on frontend menu systems and backend permission tables, without enforci…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00306 Published 2025-12-04 No fix listed CWE-266