{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jpom-2.10.0-through-2.11.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jpom:jpom:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-120201"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jpom (2.10.0 through 2.11.12)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Jpom"],"content_html":"\u003cp\u003eJpom versions 2.10.0 through 2.11.12 are vulnerable to an authentication bypass. Unauthenticated attackers can gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. By providing a value such as 'is not null', the underlying Hutool Condition parser processes the input as an operator. Once access is gained, attackers can execute commands using Jpom's script features.\u003c/p\u003e\n","date_modified":"2026-10-31T22:05:24Z","date_published":"2026-10-31T22:05:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jpom-auth-bypass-0b421525/","summary":"Jpom versions 2.10.0 through 2.11.12 contain an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access and execute commands.","title":"Jpom: Authentication bypass and command execution (CVE-2026-120201)","url":"https://feed.craftedsignal.io/briefs/2026-10-jpom-auth-bypass-0b421525/"}],"language":"en","title":"CraftedSignal Threat Feed - Jpom (2.10.0 Through 2.11.12)","version":"https://jsonfeed.org/version/1.1"}