Bladex

9 CVEs across 1 Bladex products. Browse Bladex vulnerabilities, severities, and proof-of-concept exploits.

Bladex products with known CVEs

ProductCVEs
Springblade9
Bladex CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-70982Critical9.92026-01-26Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
CVE-2025-70983Critical9.92026-01-23Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
CVE-2024-8023Medium6.32024-08-21A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list…
CVE-2024-33332High7.52024-04-30An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant.
CVE-2023-47458Critical9.82024-01-02An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.
CVE-2023-40788Medium5.32023-09-19SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error…
CVE-2023-40787Critical9.82023-08-29In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
CVE-2022-27360Critical9.82022-05-05SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
CVE-2020-16165Critical9.82020-07-30The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and des…