Yzcheng90 vulnerabilities
We track 4 vulnerabilities in Yzcheng90 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2026.
Latest Yzcheng90 vulnerabilities
- 9.1 Critical severity
X-SpringBoot: Use of Default Credentials
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint
- 9.1 Critical severity
X-SpringBoot: Improper Authentication
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addr
- 7.2 High severity
X-SpringBoot: Authorization Bypass Through User-Controlled Key
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account includi
- 7.3 High severity
X-springboot: Incorrect Privilege Assignment
This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these