rymcu vulnerabilities

Products

• forest 6

Latest rymcu CVEs

Newest publication first

1. CVE-2026-2947 rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting

   Published 2026-02-22

   Medium·CVSS 5.1 EPSS 0.33%

   A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting. The attack...

2. CVE-2026-2946 rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting

   Published 2026-02-22

   Medium·CVSS 5.1 EPSS 0.26%

   A security vulnerability has been detected in rymcu forest up to 0.0.5. Affected by this issue is the function XssUtils.replaceHtmlCode of the file src/main/java/com/rymcu/forest/util/XssUtils.java of the component Article Content/Comments/Portfolio. The manipulation leads to cro...

3. CVE-2025-12925 rymcu forest UserDicController.java deleteDic authorization

   Published 2025-11-10

   Medium·CVSS 6.9 EPSS 0.47%

   A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authori...

4. CVE-2025-12924 rymcu forest BankController.java GlobalResult authorization

   Published 2025-11-10

   Medium·CVSS 5.3 EPSS 0.37%

   A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may...

5. CVE-2025-63687 An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized at...

   Published 2025-11-07

   Medium·CVSS 6.5 EPSS 0.27%

   An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users posts.

6. CVE-2023-51804 An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file.

   Published 2024-01-13

   High·CVSS 7.5 EPSS 0.66%

   An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.