Browse CVEs

CRITICAL 9.9 CVE-2025-70982 Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive … Springblade Mitigation only Fix from $2,3002026-01-26 CRITICAL 9.9 CVE-2025-70983 Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. Springblade Mitigation only Fix from $2,3002026-01-23 CRITICAL 9.8 CVE-2024-8023 A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system… Springblade after 4.1.0 Fix from $2,3002024-08-21 HIGH 7.5 CVE-2024-33332 An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant. Springblade No fix yet Fix from $1,9502024-04-30 CRITICAL 9.8 CVE-2023-47458 An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. Springblade after 3.7.0 Fix from $2,3002024-01-02 MEDIUM 5.3 CVE-2023-40788 SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access… Springblade after 3.6.0 Fix from $1,6002023-09-19 CRITICAL 9.8 CVE-2023-40787EPSS 19% In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection. Springblade Mitigation only Fix from $2,3002023-08-29 CRITICAL 9.8 CVE-2022-27360 SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment. Springblade No fix yet Fix from $2,3002022-05-05 CRITICAL 9.8 CVE-2020-16165 The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list as… Springblade after 2.7.1 Fix from $2,3002020-07-30