elunez vulnerabilities

Products

• elunez/eladmin 13

Latest elunez CVEs

Newest publication first

1. CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete

   Published 2026-10-16

   Medium·CVSS 5.1 EPSS 0.40%

   eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DEL...

2. CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.19%

   eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download...

3. CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.21%

   Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage...

4. CVE-2025-10084 elunez eladmin SysLogController 1 queryErrorLogDetail improper authorization

   Published 2025-09-08

   Medium·CVSS 5.3 EPSS 0.30%

   A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit...

5. CVE-2025-10014 elunez eladmin Email Address updateEmail updateUserEmail improper authorization

   Published 2025-09-05

   Low·CVSS 2.3 EPSS 0.30%

   A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed...

6. CVE-2025-9937 elunez eladmin LocalStorageController deleteFile improper authorization

   Published 2025-09-03

   Medium·CVSS 5.3 EPSS 0.39%

   A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may...

7. CVE-2025-9241 elunez eladmin exportUser csv injection

   Published 2025-08-20

   Medium·CVSS 5.3 EPSS 0.35%

   A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

8. CVE-2025-9240 elunez eladmin info information disclosure

   Published 2025-08-20

   Medium·CVSS 5.3 EPSS 0.37%

   A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and m...

9. CVE-2025-9239 elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

   Published 2025-08-20

   Medium·CVSS 6.3 EPSS 0.21%

   A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STR_PARAM with t...

10. CVE-2025-8530 elunez eladmin Druid application-prod.yml default credentials

    Published 2025-08-04

    Medium·CVSS 6.9 EPSS 0.55%

    A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the component Druid. The manipulation of the argumen...

11. CVE-2025-3250 elunez eladmin Maintenance Management Module testConnect deserialization

    Published 2025-04-04

    Medium·CVSS 5.3 EPSS 0.50%

    A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The at...

12. CVE-2025-2855 elunez eladmin upload checkFile deserialization

    Published 2025-03-27

    Medium·CVSS 5.1 EPSS 0.55%

    A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotel...

13. CVE-2024-7458 elunez eladmin Database Management/Deployment Management upload path traversal

    Published 2024-08-04

    Medium·CVSS 5.1 EPSS 0.84%

    A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.