Dismissed
Permalink
CVE-2026-1062
6.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
2 packages
- tmsu
- commitmsgfmt
- @LeSuisse dismissed
xiweicheng TMS HtmlUtil.java summary server-side request forgery
A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used.
References
- VDB-341630 | xiweicheng TMS HtmlUtil.java summary server-side request forgery vdb-entry technical-description
- VDB-341630 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #731241 | https://gitee.com/xiweicheng/tms/ Merchant Mall - Mall Development/TMS 1.0 Server-Side Request Forgery third-party-advisory
- Submit #731242 | https://gitee.com/xiweicheng/tms/ Merchant Mall - Mall Development/TMS 1.0 Server-Side Request Forgery (Duplicate) third-party-advisory
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8… related
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8… exploit
- VDB-341630 | xiweicheng TMS HtmlUtil.java summary server-side request forgery vdb-entry technical-description
- VDB-341630 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #731241 | https://gitee.com/xiweicheng/tms/ Merchant Mall - Mall Development/TMS 1.0 Server-Side Request Forgery third-party-advisory
- Submit #731242 | https://gitee.com/xiweicheng/tms/ Merchant Mall - Mall Development/TMS 1.0 Server-Side Request Forgery (Duplicate) third-party-advisory
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8… related
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8… exploit
Affected products
TMS
- ==2.11
- ==2.12
- ==2.9
- ==2.18
- ==2.22
- ==2.5
- ==2.25
- ==2.10
- ==2.6
- ==2.2
- ==2.16
- ==2.0
- ==2.27
- ==2.17
- ==2.23
- ==2.8
- ==2.19
- ==2.28.0
- ==2.1
- ==2.13
- ==2.24
- ==2.26
- ==2.20
- ==2.21
- ==2.14
- ==2.15
- ==2.4
- ==2.3
- ==2.7