gin-vue-admin vulnerabilities
10 known vulnerabilities in gin-vue-admin from Flipped-aurora. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
gin-vue-admin: Improper Neutralization of Special Elements used in an OS Command
gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attacker with access to the code-generation feature and MCP management interface can exploit this vulnerability by injecting attacker-controlled Go source code throu
- 7.2 High severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, t
- 9.1 Critical severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any fi
- 8.8 High severity
gin-vue-admin: Improper Neutralization of Special Elements used in an SQL Command
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities occur when a web application allows users to input data into SQL queries without sufficiently valida
- 7.7 High severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the
- 7.5 High severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch
- 9.8 Critical severity
gin-vue-admin: Unrestricted Upload of File with Dangerous Type
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in
- 7.5 High severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1.
- 8.8 High severity
gin-vue-admin: Improper Neutralization of Special Elements used in an SQL Command
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the
- 8.1 High severity
gin-vue-admin: Missing Authorization
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as possi