Anji-plus vulnerabilities
We track 8 vulnerabilities in Anji-plus products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2026.
Latest Anji-plus vulnerabilities
- 9.8 Critical severity
AJ-Report: Use of Hard-coded Cryptographic Key
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoade
- 9.8 Critical severity
AJ-Report: Authentication Bypass Using an Alternate Path or Channel
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was obser
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclo
- 9.8 Critical severity
AJ-Report: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The expl
- 9.8 Critical severity
AJ-Report: Deserialization of Untrusted Data
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the component com.anjiplus.template.gaea.business.modules.datasetparam.controller.DataSetParamController#veri
- 9.8 Critical severity
AJ-Report: Deserialization of Untrusted Data
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be laun
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The manipulation of the argument p leads to sql injection. It is possible to launch the attack remotely.