Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

CVE-2026-92603

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Continew
Products
Admin Continew Admin
CVE-2025-4551

ContiNew Admin file cross site scripting

A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Continew
Products
Admin Continew Admin
CVE-2024-8150

ContiNew Admin user sql injection

A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Affected by this issue is the function top.continew.starter.extension.crud.controller.BaseController#page of the file /api/system/user?deptId=1&page=1&size=10. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Continew
Products
Admin Continew Admin
CVE-2024-8155

ContiNew Admin tree sql injection

A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Affected by this vulnerability is the function top.continew.starter.extension.crud.controller.BaseController#tree of the file /api/system/dept/tree?sort=parentId%2Casc&sort=sort%2Casc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Continew
Products
Admin