Repository Issue Activity (beta)

#913 Courtesy notice for an independent Java 21 and Spring Boot 4.1.1 port

#912 [Security] JWT userId 未与 Redis 在线会话绑定，导致跨用户身份混淆与条件性垂直越权

#903 [Security] Missing authorization on Tools (Email / Alipay) and Code-Generator controllers enables vertical privilege escalation

#910 [Security] Broken Access Control - UserController

#909 [Security] Broken Access Control - LocalStorageController

#906 [Security] OS command injection in deploy server-reduction (`appName`)

#907 [Security] SSRF via attacker-controlled JDBC URL in database maintenance endpoints

#908 [Security] Arbitrary file write via code-generator `tableName` (path traversal)

#868 The version of the MySQL connector used by eladmin v2.6 is outdated, which makes it vulnerable to JDBC deserialization attacks.

#901 [Security]Directory Traversal in File Upload Path Construction Allows Write Outside the Intended Upload Directory

#904 Arbitrary file read via /api/database/testConnect: the sanitizeJdbcUrl blocklist is bypassable

#902 [Security]Users with low privileges can reset the password of any user.

#900 [Security] Server-Side Request Forgery (SSRF) via Insecure JDBC Connection Testing

#899 [Secruity] Command Injection via SSH Script Injection in App Management in elunez_eladmin

#898 PUT /api/roles 权限检查绕过

#897 isAdmin标志导致垂直越权

#891 数据库连接串不起作用

#892 建议修改tableName传参方式

#886 CSV/XLSX Injection in 19 Endpoints of eladmin ≤ 2.7 (CWE-1236)

#888 Authenticated cmdi: startServer execute request-body scripts on deployed servers

#885 Sensitive Information Disclosure via /auth/info in eladmin ≤ 2.7(CWE-200)

#883 Druid credentials hardcoded vulnerability

#884 Hardcoded DES Key Vulnerability in eladmin ≤ 2.7(CWE-321)

#870 [线程安全] TokenProvider类中复用 JwtBuilder 实例导致并发环境下 Token 生成错误

#873 There is a command execution vulnerability in version 2.7