Shenxiusecurity

Name of the Vulnerable Software and Affected Versions: jshERP versions up to 3.5 Description: A critical issue exists in jshERP that allows for path traversal. The `exportExcelByParam` function within the `/src/main/java/com/jsh/erp/controller/SystemConfigController.java` file is affected. Manipulation of the `Title` argument enables the exploitation of this issue, and it can be initiated remotely. The exploit has been publicly disclosed. The vendor was notified but did not respond. Recommendations: Versions prior to 3.5: Address the path traversal issue in the `exportExcelByParam` function by sanitizing the `Title` argument.

Name of the Vulnerable Software and Affected Versions: risesoft-y9 Digital-Infrastructure versions prior to 9.6.8 Description: A critical issue affects the deleteFile function in the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java. The manipulation of the `fullPath` argument leads to path traversal. This issue can be exploited remotely. An exploit has been publicly disclosed and may be utilized. The vendor was contacted prior to this disclosure but did not respond. Recommendations: For risesoft-y9 Digital-Infrastructure versions prior to 9.6.8, as a temporary workaround, consider disabling the `deleteFile` function in the Y9FileController.java file until a patch is available. Restrict access to the vulnerable filemanager module to minimize the risk of exploitation. Avoid using the `fullPath` argument in the affected function until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Dromara RuoYi-Vue-Plus version 5.4.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the `filePath` argument leads to path traversal. This issue can be exploited remotely. Recommendations: For Dromara RuoYi-Vue-Plus version 5.4.0, as a temporary workaround, consider restricting access to the Mail Handler component to minimize the risk of exploitation. Avoid using the `filePath` argument in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: diyhi bbs versions up to 6.8 Description: A critical issue has been discovered that affects the `getUrl` function of the `/admin/login` file in the HTTP Header Handler component. The manipulation of the `Host` argument leads to server-side request forgery, which can be initiated remotely. Recommendations: For versions up to 6.8, consider restricting access to the `/admin/login` endpoint until a patch is available. As a temporary workaround, consider disabling the `getUrl` function of the HTTP Header Handler component to minimize the risk of exploitation. Avoid using the `Host` argument in the affected HTTP Header Handler component until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue was found in the software, affecting the /xxl-sso-server/login file. The manipulation of the `errorMsg` argument leads to cross-site scripting. The attack can be initiated remotely. Recommendations: For Xuxueli xxl-sso version 1.1.0, as a temporary workaround, consider restricting access to the `/xxl-sso-server/login` endpoint until a patch is available. Avoid using the `errorMsg` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: yzcheng90 X-SpringBoot versions up to 5.0 Description: A critical issue was found in the function `uploadApk` of the file `/sys/oss/upload/apk` of the component APK File Handler. The manipulation of the argument `File` leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For yzcheng90 X-SpringBoot versions up to 5.0, as a temporary workaround, consider disabling the `uploadApk` function until a patch is available. Restrict access to the `/sys/oss/upload/apk` file to minimize the risk of exploitation. Avoid using the `File` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue has been found in the software, affecting the processing of the file /xxl-sso-server/doLogin. The manipulation of the `redirect url` argument leads to an open redirect. This issue can be exploited remotely. Recommendations: For Xuxueli xxl-sso version 1.1.0, as a temporary workaround, consider restricting access to the /xxl-sso-server/doLogin endpoint to minimize the risk of exploitation. Avoid using the `redirect url` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: java-aodeng Hope-Boot version 1.0.0 Description: A issue was found in the Login function of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the `errorMsg` argument leads to cross-site scripting. The attack may be initiated remotely. Recommendations: For java-aodeng Hope-Boot version 1.0.0, as a temporary workaround, consider restricting the use of the `Login` function in the WebController until a patch is available. Avoid using the `errorMsg` argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: java-aodeng Hope-Boot version 1.0.0 Description: A vulnerability was found in the function `doLogin` of the file `/src/main/java/com/hope/controller/WebController.java` of the component Login. The manipulation of the argument `redirect url` leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For version 1.0.0, as a temporary workaround, consider restricting the use of the `redirect url` argument in the `doLogin` function until a patch is available. Restrict access to the `/src/main/java/com/hope/controller/WebController.java` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: seaswalker spring-analysis up to 4379cce848af96997a9d7ef91d594aa129be8d71 Description: A vulnerability was found in the function `echo` of the file /src/main/java/controller/SimpleController.java. The manipulation of the argument `Name` leads to cross-site scripting. The attack can be launched remotely. Recommendations: For seaswalker spring-analysis up to 4379cce848af96997a9d7ef91d594aa129be8d71, as a temporary workaround, consider restricting access to the `echo` function in the SimpleController.java file until a fix is available. Avoid using the `Name` argument in the affected function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: diyhi bbs version 6.8 Description: A critical issue has been discovered, affecting the `Add` function of the `ForumManageAction.java` file. The manipulation of the `dirName` argument leads to path traversal. This issue can be exploited remotely. Recommendations: For diyhi bbs version 6.8, as a temporary workaround, consider restricting access to the `Add` function of the `ForumManageAction.java` file until a patch is available. Avoid using the `dirName` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa **Description** A critical issue was found in the function `watermarkTest` of the file `/springbt watermark/src/main/java/cn/codesheep/springbt watermark/service/ImageUploadService.java` of the component File Upload. The manipulation of the argument `filename` leads to path traversal. The attack can be launched remotely. **Recommendations** As a temporary workaround, consider disabling the `watermarkTest` function until a fix is available. Restrict access to the File Upload component to minimize the risk of exploitation. Avoid using the `filename` argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** javahongxi whatsmars version 2021.4.0 **Description** A problem has been found that affects the `initialize` function of the file `/whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java`. The manipulation of the `artifactId` argument leads to path traversal. This issue can be exploited remotely. The exploit has been made public and may be used. The vendor was contacted about this disclosure but did not respond. **Recommendations** For version 2021.4.0, as a temporary workaround, consider restricting access to the `initialize` function of the `InitializrController.java` file to minimize the risk of exploitation. Avoid using the `artifactId` argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CoinExchange CryptoExchange Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa Description: A critical vulnerability has been found in CoinExchange CryptoExchange Java, affecting the `uploadLocalImage` function of the File Upload Endpoint. The manipulation of the `filename` argument leads to path traversal, allowing remote attacks. The exploit has been publicly disclosed. Recommendations: As a temporary workaround, consider disabling the `uploadLocalImage` function until a fix is available. Restrict access to the File Upload Endpoint to minimize the risk of exploitation. Avoid using the `filename` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd **Description** A critical issue affects some unknown functionality of the file "/api/v1/admin/" of the component File Upload Endpoint. The manipulation of the `filename` argument leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product utilizes continuous delivery with rolling releases, so no version details of affected or updated releases are available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: kanwangzjm Funiture versions up to 71ca0fb0658b3d839d9e049ac36429207f05329b Description: A problematic issue was found in the `doPost` function of the `LoginServlet.java` file, affecting the Login component. The manipulation of the `ret` argument leads to an open redirect. This issue can be exploited remotely. Recommendations: For versions up to 71ca0fb0658b3d839d9e049ac36429207f05329b, as a temporary workaround, consider restricting access to the `doPost` function of the `LoginServlet.java` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: itwanger paicoding versions 1.0.0 through 1.0.3 Description: A vulnerability has been found in the software, classified as problematic. It affects an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java, leading to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, with a rather high complexity, making exploitation difficult. Recommendations: For versions 1.0.0 through 1.0.3, consider restricting access to the affected functionality in the CrossUtil.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Freeebird Hotel 酒店管理系统 API versions up to 1.2 **Description** A problematic issue has been found in the API, affecting some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. This leads to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, with a rather high complexity and difficult exploitation. **Recommendations** For Freeebird Hotel 酒店管理系统 API versions up to 1.2, consider restricting access to the SessionInterceptor.java file as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** vector4wang spring-boot-quick up to 20250422 **Description** A critical issue affects the function `ResponseEntity` of the file `/spring-boot-quick-master/quick-img2txt/src/main/java/com/quick/controller/Img2TxtController.java` of the component `quick-img2txt`. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** spring-cloud-base versions up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa **Description** A problem has been declared in the function `sendBack` of the file /spring-cloud-base-master/auth-center/auth-center-provider/src/main/java/com/peng/auth/provider/config/web/MvcController.java, which is part of the HTTP Header Handler component. The manipulation of the `Referer` argument leads to an open redirect. This issue can be exploited remotely. **Recommendations** For spring-cloud-base versions up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa, as a temporary workaround, consider restricting access to the `sendBack` function in the MvcController.java file until a fix is available. Additionally, restrict the manipulation of the `Referer` argument to prevent open redirect attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.