GCVE - cpe:2.3:a:cjbi:admin3:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cjbi:admin3:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cjbi (`01462943-bc01-5b18-a682-16e1c2894b47`)
Product	Admin3 (`e1d15756-41d1-506e-9455-bbe1d3bec74e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gitee/cjbi/admin3`	purl2cpe	2026-09-09 08:34:09.255762
`pkg:github/cjbi/admin3`	purl2cpe	2026-09-09 08:34:09.255766

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92921`	vulnerable	2026-10-13 12:28:53.555796	admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5 MEDIUM (4.9) admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort. Published: 2026-09-17T12:33:25.228Z Updated: 2026-09-24T14:22:58.598Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/common/SecurityUtil.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/model/UserCredential.java https://github.com/cjbi/admin3 https://www.vulncheck.com/advisories/admin3-through-3.0.0-weak-password-hashing-via-single-round-md5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-92918`	vulnerable	2026-10-13 12:28:53.520518	admin3 through 3.0.0 Session Token Disclosure via Audit Log HIGH (8.8) admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access. Published: 2026-09-17T12:33:23.125Z Updated: 2026-09-24T14:22:55.629Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_session_token_disclosure.py https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/service/LogService.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/service/DefaultSessionService.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/resources/data.sql https://github.com/cjbi/admin3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-92919`	vulnerable	2026-10-13 12:28:53.461908	admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename HIGH (8.1) admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process. Published: 2026-09-17T12:33:23.853Z Updated: 2026-09-24T14:22:56.749Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C03_storage_path_traversal_write.py https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/storage/LocalStorage.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/storage/StorageServiceImpl.java https://github.com/cjbi/admin3 https://www.vulncheck.com/advisories/admin3-through-3.0.0-arbitrary-file-write-via-path-traversal-in-storage-upload-filename	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-92920`	vulnerable	2026-10-13 12:28:53.344063	admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled MEDIUM (5.4) admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request. Published: 2026-09-17T12:33:24.541Z Updated: 2026-09-24T14:22:57.685Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/service/UserService.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/AuthInterceptor.java https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/service/LocalSessionManager.java https://github.com/cjbi/admin3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Admin3

Notes

PURL mappings

Vulnerability references

Contribute