Search results

[Security] Broken Access Control - UserController

Status: Open.

#910 In elunez/eladmin;

· StephenClash opened on Jul 1, 2026

[Security] Broken Access Control - LocalStorageController

Status: Open.

#909 In elunez/eladmin;

· StephenClash opened on Jul 1, 2026

[Security] Arbitrary file write via code-generator tableName (path traversal)

Status: Open.

#908 In elunez/eladmin;

· Ku4D3 opened on Jun 25, 2026

[Security] SSRF via attacker-controlled JDBC URL in database maintenance endpoints

Status: Open.

#907 In elunez/eladmin;

· Ku4D3 opened on Jun 25, 2026

[Security] OS command injection in deploy server-reduction (appName)

Status: Open.

#906 In elunez/eladmin;

· Ku4D3 opened on Jun 25, 2026

Arbitrary file read via /api/database/testConnect: the sanitizeJdbcUrl blocklist is bypassable

Status: Open.

#904 In elunez/eladmin;

· MarkLee131 opened on Jun 3, 2026

[Security] Missing authorization on Tools (Email / Alipay) and Code-Generator controllers enables vertical privilege escalation

Status: Open.

#903 In elunez/eladmin;

· geo-chen opened on Jun 3, 2026

[Security]Users with low privileges can reset the password of any user.

Status: Open.

#902 In elunez/eladmin;

· v9d0g opened on May 20, 2026

[Security]Directory Traversal in File Upload Path Construction Allows Write Outside the Intended Upload Directory

Status: Open.

#901 In elunez/eladmin;

· v9d0g opened on May 20, 2026

[Security] Server-Side Request Forgery (SSRF) via Insecure JDBC Connection Testing

Status: Open.

#900 In elunez/eladmin;

· AnalogyC0de opened on May 13, 2026

[Secruity] Command Injection via SSH Script Injection in App Management in elunez_eladmin

Status: Open.

#899 In elunez/eladmin;

· AnalogyC0de opened on May 13, 2026

建议修改tableName传参方式

Status: Open.

#892 In elunez/eladmin;

· v9d0g opened on Mar 28, 2026