CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-10-31
Jpom Authentication Bypass and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-120201)
[Affected Scope] Jpom versions 2.10.0 through 2.11.12
[Impact] Unauthenticated remote attackers can bypass authentication to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header, leading to arbitrary command execution via script features
[Mitigation] Immediately upgrade Jpom to the patched version (2.11.13 or later) and restrict external access to the management console