| CVE-2024-45944 | 严重9.8 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution. | 18/10/2024 |
| CVE-2024-35091 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. | 23/05/2024 |
| CVE-2024-35090 | 高危8.2 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. | 23/05/2024 |
| CVE-2024-35086 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . | 23/05/2024 |
| CVE-2024-35085 | 中危5.4 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. | 23/05/2024 |
| CVE-2024-35084 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. | 23/05/2024 |
| CVE-2024-35083 | 高危8.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. | 23/05/2024 |
| CVE-2024-35082 | 中危6.3 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. | 23/05/2024 |
| CVE-2024-33164 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. | 07/05/2024 |
| CVE-2024-33161 | 中危5.3 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. | 07/05/2024 |
| CVE-2024-33155 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. | 07/05/2024 |
| CVE-2024-33153 | 严重9.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. | 07/05/2024 |
| CVE-2024-33149 | 高危8.1 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. | 07/05/2024 |
| CVE-2024-33148 | 高危7.3 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. | 07/05/2024 |
| CVE-2024-33147 | 高危8.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. | 07/05/2024 |
| CVE-2024-33146 | 严重9.1 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. | 07/05/2024 |
| CVE-2024-33144 | 高危8.8 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. | 07/05/2024 |
| CVE-2024-33139 | 高危7.5 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. | 07/05/2024 |
| CVE-2023-2476 | 中危5.4 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed | 02/05/2023 |
| CVE-2023-2475 | 中危5.4 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the publ | 02/05/2023 |