Yaqi Chao

eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson

JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter

JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId

jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 Mass Assignment via PUT /user/update