dromara lamp-cloud vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest dromara lamp-cloud vulnerabilities

CVE-2026-109168 — lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId (CVSS 6.5)
CVE-2026-109166 — lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById (CVSS 6.5)
CVE-2026-94536 — lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource (CVSS 4.3)
CVE-2026-94535 — lamp-cloud through 5.10.0 Unauthorized Notification Deletion (CVSS 7.1)
CVE-2026-94534 — lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints (CVSS 7.1)
CVE-2026-94533 — lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file (CVSS 6.5)
CVE-2026-94532 — lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById (CVSS 6.5)
CVE-2026-91996 — lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint (CVSS 7.5)
CVE-2026-19758 — dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal (CVSS 7.3)
CVE-2026-19757 — Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal (CVSS 7.3)
CVE-2026-19756 — Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal (CVSS 6.3)
CVE-2026-69100 — LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution (CVSS 8.8)
CVE-2026-9498 — Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine (CVSS 6.3)
CVE-2026-5529 — Dromara lamp-cloud DefUserController pageUser improper authorization (CVSS 4.3)