Cjbi vulnerabilities
We track 5 vulnerabilities in Cjbi products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Cjbi vulnerabilities
- 8.1 High severity
admin3: Improper Limitation of a Pathname to a Restricted Directory
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured s
- 8.8 High severity
admin3: Insertion of Sensitive Information into Log File
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bea
- 8.8 High severity
wetech-cms: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\UserDao.java. The manipulation of th
- 8.8 High severity
wetech-cms: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been classified as critical. Affected is the function searchTopic of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument con l
- 8.8 High severity
wetech-cms: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function searchTopicByKeyword of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argumen