BL
Vendor
Bladex
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-70982 | SP Springblade Bladex | 9.9 | Jan 26 | Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data |
| CVE-2025-70983 | SP Springblade Bladex | 9.9 | Jan 23 | Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges |
| CVE-2024-8023 | SP Springblade Bladex | 9.8 | Aug 20 | chillzhuang SpringBlade list sql injection |
| CVE-2024-33332 | SP Springblade Bladex | 7.5 | Apr 30 | An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant |
| CVE-2023-47458 | SP Springblade Bladex | 9.8 | Jan 2 | An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework |
| CVE-2023-40788 | SP Springblade Bladex | 5.3 | Sep 18 | SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs |
| CVE-2023-40787 | SP Springblade Bladex | 9.8 | Aug 29 | In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection |
| CVE-2022-27360 | SP Springblade Bladex | 9.8 | May 5 | SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment |
| CVE-2020-16165 | SP Springblade Bladex | 9.8 | Jul 30 | The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause |