Vulnerabilidades do Pig-mesh Pig
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Pig-mesh Pig: 3 registro(s), com versões afetadas e correções.
CVE-2026-111343
Média · 4.3
CWE-862 15/10/2026
pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
CVE-2026-91995
Crítica · 9.1
CWE-620 15/09/2026
pig before 4.1.0 Unverified Password Change via /register/password
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
CVE-2026-15512
Média · 6.3
CWE-74 12/07/2026
pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.