AJ-Report vulnerabilities

CVEs whose affected-version data names the AJ-Report package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120209Critical· 9.8PoC

1w ago

AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scri…

▾ Abyssalanji-plus · AJ-ReportEPSS 0.54%via CVEORG