com.dianping.cat vulnerabilities

Products

• com.dianping.cat/parent 1

Latest com.dianping.cat CVEs

Newest publication first

1. CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

   Published 2026-09-03

   Critical·CVSS 9.3 EPSS 0.71%

   CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configur...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.