Issues

• RsaUtils 解密不支持分块（#634 引入），默认配置下超过 53 字节的密码无法设置

  elunez/eladmin#918 · Filter by author dispwnl opened on Sep 24, 2026

• 菜单「上级」可以设置成环，之后子菜单查询、上级查询、删除接口均 StackOverflowError，菜单也从列表中消失

  elunez/eladmin#917 · Filter by author dispwnl opened on Sep 24, 2026

• 图片后缀校验区分大小写且使用子串匹配：photo.JPG 等正常图片被拒，x.p、x.jp 等无效后缀被放行

  elunez/eladmin#916 · Filter by author dispwnl opened on Sep 24, 2026

• StringUtils.getBrowser 在请求无 User-Agent 时抛 NPE：@Log 接口操作已执行却返回 400，且不写入操作日志

  elunez/eladmin#915 · Filter by author dispwnl opened on Sep 23, 2026
  1

• Courtesy notice for an independent Java 21 and Spring Boot 4.1.1 port

  elunez/eladmin#913 · Filter by author SovNodeAI opened on Sep 1, 2026

• [Security] JWT userId 未与 Redis 在线会话绑定，导致跨用户身份混淆与条件性垂直越权

  elunez/eladmin#912 · Filter by author 28Hus opened on Aug 4, 2026
  3

• [Security] Broken Access Control - UserController

  elunez/eladmin#910 · Filter by author StephenClash opened on Jul 1, 2026

• [Security] Broken Access Control - LocalStorageController

  elunez/eladmin#909 · Filter by author StephenClash opened on Jul 1, 2026

• [Security] Arbitrary file write via code-generator tableName (path traversal)

  elunez/eladmin#908 · Filter by author Ku4D3 opened on Jun 25, 2026

• [Security] SSRF via attacker-controlled JDBC URL in database maintenance endpoints

  elunez/eladmin#907 · Filter by author Ku4D3 opened on Jun 25, 2026

• [Security] OS command injection in deploy server-reduction (appName)

  elunez/eladmin#906 · Filter by author Ku4D3 opened on Jun 25, 2026

• Arbitrary file read via /api/database/testConnect: the sanitizeJdbcUrl blocklist is bypassable

  elunez/eladmin#904 · Filter by author MarkLee131 opened on Jun 3, 2026
  1

• [Security] Missing authorization on Tools (Email / Alipay) and Code-Generator controllers enables vertical privilege escalation

  elunez/eladmin#903 · Filter by author geo-chen opened on Jun 3, 2026
  1

• [Security]Users with low privileges can reset the password of any user.

  elunez/eladmin#902 · Filter by author v9d0g opened on May 20, 2026

• [Security]Directory Traversal in File Upload Path Construction Allows Write Outside the Intended Upload Directory

  elunez/eladmin#901 · Filter by author v9d0g opened on May 20, 2026
  1

• [Security] Server-Side Request Forgery (SSRF) via Insecure JDBC Connection Testing

  elunez/eladmin#900 · Filter by author AnalogyC0de opened on May 13, 2026

• [Secruity] Command Injection via SSH Script Injection in App Management in elunez_eladmin

  elunez/eladmin#899 · Filter by author AnalogyC0de opened on May 13, 2026

• 建议修改tableName传参方式

  elunez/eladmin#892 · Filter by author v9d0g opened on Mar 28, 2026

• Authenticated cmdi: startServer execute request-body scripts on deployed servers

  elunez/eladmin#888 · Filter by author mukyuuhate opened on Feb 14, 2026

• Sensitive Information Disclosure via /auth/info in eladmin ≤ 2.7(CWE-200)

  elunez/eladmin#885 · Filter by author ez-lbz opened on Aug 10, 2025
  1

• Hardcoded DES Key Vulnerability in eladmin ≤ 2.7(CWE-321)

  elunez/eladmin#884 · Filter by author ez-lbz opened on Aug 10, 2025

• The version of the MySQL connector used by eladmin v2.6 is outdated, which makes it vulnerable to JDBC deserialization attacks.

  elunez/eladmin#868 · Filter by author ghost opened on Feb 9, 2025
  1

• 提议，增加批量代码导出接口，以及代码导出优化

  elunez/eladmin#856 · Filter by author wonderfulCoder1 opened on Aug 27, 2024
  2

• 前端代码生成-生成路径问题

  elunez/eladmin#820 · Filter by author imshiwen opened on Oct 8, 2023
  1