dianping vulnerabilities

Products

• cat 2

Latest dianping CVEs

Newest publication first

1. CVE-2026-124506 Dianping CAT Report hourlyReport.tag Model.getDomain cross site scripting

   Published 2026-11-09

   Medium·CVSS 5.3

   A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is poss...

2. CVE-2026-124505 Dianping CAT Login/Logout Handler.java Handler.redirect

   Published 2026-11-09

   Medium·CVSS 5.3

   A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The ex...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.