Yzcheng90 X-Springboot
6 CVEs affecting Yzcheng90 X-Springboot. Latest disclosed: 2026-09-25. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97064 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers… |
CVE-2026-97063 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without… |
CVE-2025-55948 | High | 7.3 | 2025-12-04 | This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on fronten… |
CVE-2026-97060 | High | 7.2 | 2026-09-25 | X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership… |
CVE-2026-100192 | Medium | 6.5 | 2026-09-25 | X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Un… |
CVE-2025-6731 | Medium | 6.3 | 2025-06-26 | A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss… |