Smartadmin
Monthly
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS remains low at 0.22% (13th percentile), so the near-maximum vendor score is not reinforced by exploitation or exploitation-likelihood signals.
SmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows authenticated remote attackers to manipulate template content and achieve code execution. The flaw exists in the MailService component's freemarkerResolverContent function and has a public exploit available. Since no patch is available and the vendor has not responded, organizations using affected versions should immediately assess exposure and consider alternative solutions.
A weakness has been identified in 1024-lab/lab1024 SmartAdmin versions up to 3.29. is affected by cross-site scripting (xss) (CVSS 3.5).
A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views/business/oa/notice/components/notice-form-drawer.vue of the component Notice Module. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for a...
An authorization bypass in the SmartAdmin (1024-lab/smart-admin) v3.30.0 configuration query endpoint allows a remote attacker to read configuration data they are not entitled to access and to escalate privileges within the application. The vendor scores this as maximum severity (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating that realistic exploitation likely requires an existing low-privilege session and that the dominant impact is disclosure of sensitive configuration content rather than full system takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS remains low at 0.22% (13th percentile), so the near-maximum vendor score is not reinforced by exploitation or exploitation-likelihood signals.
SmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows authenticated remote attackers to manipulate template content and achieve code execution. The flaw exists in the MailService component's freemarkerResolverContent function and has a public exploit available. Since no patch is available and the vendor has not responded, organizations using affected versions should immediately assess exposure and consider alternative solutions.
A weakness has been identified in 1024-lab/lab1024 SmartAdmin versions up to 3.29. is affected by cross-site scripting (xss) (CVSS 3.5).
A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views/business/oa/notice/components/notice-form-drawer.vue of the component Notice Module. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for a...