Live › vulnerability › CVE-2026-120201
Jpom, a server and script management tool, lets an unauthenticated attacker send a crafted JPOM-USER-TOKEN header that Hutool's condition parser treats as a query operator. The attacker gains super-administrator access and can then run commands through Jpom's script features.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Teams running Jpom versions 2.10.0 through 2.11.12 that accept requests from networks they do not fully control. The sources do not say whether default configurations are exposed. unknown for further detail.
No product ranges from the sources yet.
2.10.0 through 2.11.12 are listed as affected)2.11.12 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
This page as .md · .json · in your agent: get_signal("CVE-2026-120201")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.