Dromara Lamp-Cloud
14 CVEs affecting Dromara Lamp-Cloud. Latest disclosed: 2026-10-12. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69100 | High | 8.8 | 2026-08-04 | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed… |
CVE-2026-91996 | High | 7.5 | 2026-09-15 | lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system… |
CVE-2026-19758 | High | 7.3 | 2026-08-14 | A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the compo… |
CVE-2026-19757 | High | 7.3 | 2026-08-14 | A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component Fi… |
CVE-2026-94535 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users'… |
CVE-2026-94534 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify… |
CVE-2026-109168 | Medium | 6.5 | 2026-10-12 | lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attac… |
CVE-2026-109166 | Medium | 6.5 | 2026-10-12 | lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' fi… |
CVE-2026-94533 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachme… |
CVE-2026-94532 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user… |
CVE-2026-19756 | Medium | 6.3 | 2026-08-13 | A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code… |
CVE-2026-9498 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handl… |
CVE-2026-94536 | Medium | 4.3 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employe… |
CVE-2026-5529 | Medium | 4.3 | 2026-04-05 | A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component… |