CVE-2026-120201
dromara Jpom
Published 31 Oct 2026 · updated 31 Oct 2026 · Deferred
9.3 Critical · CVSS 4.0, vulncheck.com
Description
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.