CVE-2024-45944 | Critical | 9.8 | 2024-10-18 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execu… |
CVE-2024-35091 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. |
CVE-2024-35090 | High | 8.2 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. |
CVE-2024-35086 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . |
CVE-2024-35085 | Medium | 5.4 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. |
CVE-2024-35084 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. |
CVE-2024-35083 | High | 8.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. |
CVE-2024-35082 | Medium | 6.3 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. |
CVE-2024-33164 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
CVE-2024-33161 | Medium | 5.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
CVE-2024-33155 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
CVE-2024-33153 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
CVE-2024-33149 | High | 8.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
CVE-2024-33148 | High | 7.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
CVE-2024-33147 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
CVE-2024-33146 | Critical | 9.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
CVE-2024-33144 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
CVE-2024-33139 | High | 7.5 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
CVE-2023-2476 | Low | 3.5 | 2023-05-02 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement… |
CVE-2023-2475 | Low | 3.5 | 2023-05-02 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Mes… |
CVE-2021-28890 | Critical | 9.8 | 2021-08-12 | J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list… |