CVE-2026-120201

CriticalCVSS 9.8/10Last modified Nov 9, 2026

Description

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-943

Affected software

Vendor	Product	Versions
dromara	Jpom	>= 2.10.0, <= 2.11.12

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1202026.5Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads becau CVE-2026-1202038.8ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell com CVE-2026-1202045.6DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to cre CVE-2026-1202058.0Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attac CVE-2026-1202065.9Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative act CVE-2026-1202077.1Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, docume CVE-2026-1202087.5libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows CVE-2026-1202099.8AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers c CVE-2026-1202104.3FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package CVE-2026-120212Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string CVE-2026-1202139.1@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 throug CVE-2026-1202145.9@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 throu