Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2021-28890

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, related to the use of ${} to join SQL statements.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
J2eefast
Products
J2eefast