Dromara vulnerabilities
62 CVEs and advisories name Dromara as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-19756Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal
- CVE-2026-69102MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
- CVE-2026-69100LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
- CVE-2026-67345MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
- CVE-2026-58176RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
- CVE-2026-9498Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
- CVE-2026-7699Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
- CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
- CVE-2026-5529Dromara lamp-cloud DefUserController pageUser improper authorization
- CVE-2026-2954Dromara UJCMS ImportDataController import-channel importChanel injection
- CVE-2026-2953Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal
- CVE-2026-2819Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization
- CVE-2025-15222Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization
- CVE-2025-15117Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization
- CVE-2025-13268Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
- CVE-2025-7552Dromara Northstar Path AuthorizationInterceptor.java preHandle access control
- CVE-2025-6925Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
- CVE-2025-6517Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
- CVE-2025-2491Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
- CVE-2025-2490Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting
- CVE-2024-12483Dromara UJCMS User ID id authorization
- CVE-2024-3928Dromara open-capacity-platform auth-server heapdump information disclosure
- CVE-2023-51389HertzBeat SnakeYAML Deser RCE
- CVE-2023-51388HertzBeat AviatorScript Inject RCE
- CVE-2023-51653Hertzbeat JMX JNDI RCE
- CVE-2023-51650Unauthorized access vulnerability on three interfaces
- CVE-2023-51387Expression Injection Vulnerability in Hertzbeat
- CVE-2022-39337Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
- CVE-2023-3276Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference
- CVE-2023-2476Dromara J2eeFAST Announcement cross site scripting