Vendor

    Dromara

    61 known vulnerabilities in products by Dromara, 0 of them actively exploited (CISA KEV).

    Key figures

    61

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    14

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Dromara
    CriticalCVE-2026-107780

    Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter

    		9.8
    CriticalCVE-2023-51653

    Hertzbeat JMX JNDI RCE

    also in 1 other product

    		9.8
    MediumCVE-2026-92993

    Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

    		6.3
    MediumCVE-2024-12483

    Dromara UJCMS User ID id authorization

    also in 1 other product

    		3.7
    HighCVE-2026-69100

    LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

    		8.8
    CriticalCVE-2026-107779

    Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE

    		9.8
    CriticalCVE-2023-51388

    HertzBeat AviatorScript Inject RCE

    also in 1 other product

    		9.8
    CriticalCVE-2023-51389

    HertzBeat SnakeYAML Deser RCE

    also in 1 other product

    		9.8
    CriticalCVE-2026-69102

    MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

    		9.8
    CriticalCVE-2023-44794

    Dromara Sa-Token: Privilege Escalation

    		9.8
    HighCVE-2026-91996

    lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

    		7.5
    CriticalCVE-2023-31581

    Dromara Sureness: Hard-coded Credentials

    		9.8
    CriticalCVE-2025-66916

    Dromara RuoYi-Vue-Plus: security vulnerability

    		9.4
    HighCVE-2026-90510

    dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

    		8.3
    HighCVE-2023-51387

    Expression Injection Vulnerability in Hertzbeat

    also in 1 other product

    		7.2
    HighCVE-2026-67345

    MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

    		8.1
    CriticalCVE-2026-107781

    Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

    		7.4
    MediumCVE-2026-93961

    Dromara UJCMS UserController UserController.java usernameExist improper authorization

    		5.3
    HighCVE-2023-43961

    Dromara Sa-Token: Authentication Bypass

    		8.8
    HighCVE-2026-19758

    dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal

    		7.3
    HighCVE-2026-19757

    Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal

    		7.3
    HighCVE-2026-110609

    Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

    		6.5
    HighCVE-2026-90509

    dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

    		7.3
    HighCVE-2026-94534

    lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

    		7.1
    HighCVE-2026-111605

    Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

    		8.1

    All vulnerabilities in search

    News

    Products

    Products by Dromara
    Lamp-cloud140
    Dromara UJCMS70
    Dromara RuoYi-Vue-Plus60
    Hertzbeat60
    Dromara Sa-Token40
    MaxKey40
    Skyeye40