Mingsheng Lin

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource

jshERP through 3.6 Password Hash Disclosure via /user/info

jshERP through 3.6 Unauthorized Access via by-id Endpoints

lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 Privilege Escalation via Role Management