Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2904▼ 176 respecto a la semana anterior

Críticas / altas1294▼ 55 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)487▼ 22 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-16450	Aplazada	Baja (2.1)	0.37%	—	Zsadmin2025 Zs-admin^AI Mybatis-plus^AI	21/7/2026	23/7/2026	A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization bypass. The attack may be…
CVE-2026-7060	Aplazada	Media (5.5)	0.43%	—	Liyupi Yu-picture^AI Baomidou Mybatis-plus^AI	26/4/2026	17/6/2026	A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument…
CVE-2024-35548	Aplazada	Media (5.4)	0.37%	—	Mybatis Plus^AI	28/5/2024	17/6/2026	A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL…
CVE-2022-25517	Modificada	Crítica (9.8)	2.0%	—	Baomidou Mybatis-plus	22/3/2022	17/6/2026	MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor's position is that the reported execution of a SQL statement was intended behavior.