Summary
generated automatically from NVD dataJpom versions 2.10.0 through 2.11.12 have an authentication bypass in how the JPOM-USER-TOKEN header is handled (CWE-943). An unauthenticated attacker can supply a value such as 'is not null', which Hutool's Condition parser interprets as an operator, resulting in super-administrator access. The attacker can then run commands through Jpom's script features. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
CVSS v3.1 Score
Information
- Published
- 31 oct. 2026
- Updated
- 31 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (4)
Similar CVEs
Other vulnerabilities of type CWE-943
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.