CVE ID :CVE-2026-120201
Published : Oct. 31, 2026, 5:25 p.m. | 1 hour, 1 minute ago
Description :Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like ‘is not null’, which Hutool’s Condition parser treats as an operator, then execute commands through Jpom’s script features.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More