Hsweb Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:hs-web:hsweb-framework:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Hs Web (b1300be2-0701-5415-a3a0-920d8dd9eb6f) |
|---|---|
| Product | Hsweb Framework (b92f7e4a-09d5-5608-bb4a-ba8428a8c49b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-11477 |
vulnerable | 2026-06-08 07:47:14.205943 |
hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect
MEDIUM (4.3)
A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue.
Published: 2026-06-08T01:45:11.512Z
Updated: 2026-06-08T13:42:42.500Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11470 |
vulnerable | 2026-06-08 07:47:14.199986 |
hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal
MEDIUM (6.3)
A vulnerability has been found in hs-web hsweb-framework up to 5.0.1. The affected element is the function denied of the file hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java of the component File Upload. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8009845b577d8a2c4bbf4fdd8e8913799a714be6. It is suggested to install a patch to address this issue.
Published: 2026-06-08T00:00:16.276Z
Updated: 2026-06-08T13:03:33.387Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.