CVE-2026-120201 — Vulnerability intelligence
dromara — Jpom
Published:
- CVSS
- 9.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.