1024-lab vulnerabilities

Products

• SmartAdmin 4
• smart-admin 2

Latest 1024-lab CVEs

Newest publication first

1. CVE-2026-110117 SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController

   Published 2026-10-13

   High·CVSS 7.1 EPSS 0.28%

   SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpo...

2. CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control

   Published 2026-10-12

   Medium·CVSS 5.3 EPSS 0.21%

   A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper ac...

3. CVE-2026-7468 1024-lab smart-admin Demo Site index.html access control

   Published 2026-04-30

   Medium·CVSS 6.9 EPSS 0.36%

   A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html of the component Demo Site. The manipulation leads to improper access controls. The attack may be initiated remotely. Th...

4. CVE-2026-3725 1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine

   Published 2026-03-08

   Medium·CVSS 5.3 EPSS 0.45%

   A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a m...

5. CVE-2026-3721 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting

   Published 2026-03-08

   Medium·CVSS 5.1 EPSS 0.31%

   A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This mani...

6. CVE-2026-3720 1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting

   Published 2026-03-08

   Medium·CVSS 5.1 EPSS 0.26%

   A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views/business/oa/notice/components/notice-form-drawer.vue of the component Notice Module. The manipulation results in cross s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.