Django Sspanel
Monthly
Authorization bypass in the TicketDetailView component of Ehco1996 django-sspanel allows authenticated remote users to access support tickets belonging to other users by manipulating a user-controlled key in requests to apps/sspanel/views.py. All releases through 2023.12.26 are affected per ENISA EUVD-2026-52981. No patch will be issued - the maintainer has abandoned the project and did not respond to disclosure - leaving operators with no vendor remediation path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authorization bypass in the TicketDetailView component of Ehco1996 django-sspanel allows authenticated remote users to access support tickets belonging to other users by manipulating a user-controlled key in requests to apps/sspanel/views.py. All releases through 2023.12.26 are affected per ENISA EUVD-2026-52981. No patch will be issued - the maintainer has abandoned the project and did not respond to disclosure - leaving operators with no vendor remediation path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.