Login Request a demo
SA
Product
Sa-Token
by Dromara · last CVE Dec 30, 2025
4
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 1High 1Medium 1Low 1
Severity
All severities4Critical1High1Medium1Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Sa-Token to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-44794
9.8
1%
Oct 25
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL
Affected: before 1.37.0
CVE-2023-43961
8.8
1%
Oct 25
An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass
Affected: before 1.36.0
CVE-2025-15222
5.0
0%
Dec 30
Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization
Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more
CVE-2025-15117
3.1
0%
Dec 28
Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization
Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more
Showing 4