Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-92600

Guns through 8.3.5 Information Disclosure via Missing Permission Check

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stylefeng
Products
Guns
CVE-2026-92601

Guns through 8.3.5 Improper Access Control via SysNoticeController

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stylefeng
Products
Guns