VendorsBladexspringbladeall versions
Vulnerabilities

Bladex Springblade

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2025-70983
Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
Published 2026-01-23 · Analyzed
9.9EPSS 0.004
CVE-2025-70982
Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
Published 2026-01-26 · Analyzed
9.9EPSS 0.003
CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
Published 2023-08-29 · Modified
9.8EPSS 0.182
CVE-2022-27360
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
Published 2022-05-05 · Modified
9.8EPSS 0.020
CVE-2020-16165
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters.
Published 2020-07-30 · Modified
9.8EPSS 0.012
CVE-2023-47458
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.
Published 2024-01-02 · Modified
9.8EPSS 0.006
CVE-2024-8023
chillzhuang SpringBlade list sql injection
Published 2024-08-20 · Analyzed
9.8EPSS 0.006
CVE-2024-33332
An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant.
Published 2024-04-30 · Analyzed
7.5EPSS 0.007
CVE-2023-40788
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs
Published 2023-09-18 · Modified
5.3EPSS 0.008