by Kastro CVE-2026-120201
dromara Jpom — Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
Description · from the CVE record
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Affected
ProductAffectedFixed inSource
Jpom2.10.0 – 2.11.12–CNA
Scores by source
VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N