18
CVEs
0
Critical
2
High
0
KEV
18
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
1
LOW
15
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-65879 | Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads. | HIGH | 8.1 | 0.9% | 61 |
PoC
No patch
|
| CVE-2025-65878 | The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to the leakage of sensitive system information. | HIGH | 7.5 | 0.7% | 58 |
PoC
No patch
|
| CVE-2025-15432 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. [CVSS 5.3 MEDIUM] | MEDIUM | 5.3 | 0.3% | 47 |
PoC
No patch
|
| CVE-2026-18903 | Path traversal in yeqifu warehouse (all commits up to aaf29962ba407d22d991781de28796ee7b4670e4) enables authenticated remote attackers to read arbitrary files outside the intended web root by supplying directory-traversal sequences in the `path` argument handled by FileController.java. The exploit has been publicly disclosed and proof-of-concept code is available via VulDB and an external Notion document, raising the urgency despite a moderate CVSS 4.0 score of 5.3. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving all deployments of this Java-based warehouse management application unmitigated. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-0571 | Path traversal in the yeqifu Warehouse application's file handling function allows authenticated attackers to read arbitrary files on the system through manipulated path parameters. Public exploit code exists for this vulnerability, increasing the risk of exploitation. The rolling-release nature of the product means affected users lack clear version guidance and no official patch is currently available. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2076 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. [CVSS 6.3 MEDIUM] | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2077 | Improper authorization in yeqifu Warehouse's Role Management Handler (addRole/updateRole/deleteRole functions) allows authenticated remote attackers to perform unauthorized privilege escalation and data manipulation. Public exploit code exists for this vulnerability, and the vendor has not released a patch or responded to disclosure. An attacker with valid credentials can bypass authorization controls to modify system roles and access restrictions. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2078 | Improper authorization in the Permission Management component of yeqifu Warehouse allows authenticated remote attackers to manipulate permission-related functions (addPermission, updatePermission, deletePermission) and gain unauthorized access or modify system permissions. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects Java-based Warehouse deployments with a CVSS score of 6.3. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2079 | Improper authorization in the Menu Management component of Yeqifu Warehouse allows authenticated remote attackers to manipulate menu operations (add, update, delete) without proper access controls. Public exploit code exists for this vulnerability, and the maintainers have not yet released a patch despite early notification. The flaw affects Java-based deployments running the vulnerable commit and could enable unauthorized administrative actions. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2105 | Improper authorization in the Department Management component of yeqifu Warehouse allows authenticated users to manipulate department operations (add, update, delete) without proper access controls. Public exploit code exists for this vulnerability, which can be leveraged remotely by attackers with valid credentials. No patch is currently available from the vendor. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-2849 | Improper access controls in the Cache Sync Handler of yeqifu Warehouse allow authenticated remote attackers to manipulate cache operations (deleteCache, removeAllCache, syncCache) and achieve unauthorized modification or denial of service. Public exploit code exists for this vulnerability, and the vendor has not yet released a patch despite early notification. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-2850 | Improper access controls in the Customer Endpoint of yeqifu Warehouse allow authenticated remote attackers to manipulate customer data through the addCustomer, updateCustomer, and deleteCustomer functions. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch. An attacker with valid credentials can achieve unauthorized information disclosure, modification, and denial of service with low attack complexity. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-2852 | Improper access controls in the Sales endpoint of Yeqifu Warehouse allow authenticated remote attackers to manipulate sales records through the addSales, updateSales, and deleteSales functions, potentially compromising data integrity and confidentiality. Public exploit code exists for this vulnerability, and no patch is currently available despite early notification to the developers. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-0574 | Improper authorization in the saveUserRole request handler of yeqifu Warehouse allows authenticated remote attackers to gain unauthorized access to user role functionality and modify permissions. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects Java-based Warehouse deployments using the affected commit and earlier versions. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-2075 | Improper access control in the Role-Permission Binding Handler of yeqifu Warehouse allows authenticated remote attackers to modify role permissions through the saveRolePermission function, potentially gaining unauthorized access to sensitive operations. Public exploit code exists for this vulnerability, and the vendor has not yet released a patch despite early notification of the issue. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|