Dromara Vulnerabilities and Affected Products
Vulnerabilities associated with warm-flow.
Products
Clear product- hertzbeat7 vulnerabilities
- lamp-cloud6 vulnerabilities
- UJCMS5 vulnerabilities
- MaxKey4 vulnerabilities
- Sa-Token4 vulnerabilities
- J2eeFAST3 vulnerabilities
- RuoYi-Vue-Plus3 vulnerabilities
- HuTool2 vulnerabilities
- dataCompare1 vulnerability
- Northstar1 vulnerability
- open-capacity-platform1 vulnerability
- warm-flow1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-6125MEDIUM | Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionA security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. | CVSS5.3v4.0 | EPSS0.301% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |