cn.dev33 vulnerabilities

Products

• cn.dev33/sa-token-core 2

Latest cn.dev33 CVEs

Newest publication first

1. CVE-2023-43961 SaToken authentication bypass vulnerability

   Published 2023-10-25

   High·CVSS 8.8

   An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

2. CVE-2023-44794 SaToken privilege escalation vulnerability

   Published 2023-10-25

   Critical·CVSS 9.8

   An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.