chillzhuang/SpringBlade

GitHub

github.com

bladex.cn

Releases25

Frequency2 months 2 weeks

Last Release 25 days ago

Stars6.9K

SpringBlade 是一个由商业级项目升级优化而来的SpringCloud分布式微服务架构、SpringBoot单体式微服务架构并存的综合型项目，采用Java17 API重构了业务代码，完全遵循阿里巴巴编码规范。采用Spring Boot 3.5 、Spring Cloud 2025 、Mybatis 等核心技术，同时提供基于React和Vue的两个前端框架用于快速搭建企业级的SaaS多租户微服务平台。

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-36763 ↗	Apr 30, 2026Thursday, 30 April 2026, 18:16	6.1 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the content parameter.
CVE-2026-36765 ↗	Apr 30, 2026Thursday, 30 April 2026, 18:16	8.8 HIGH	—
An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
CVE-2026-36764 ↗	Apr 30, 2026Thursday, 30 April 2026, 17:16	5 MEDIUM	—
A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.
CVE-2025-70982 ↗	Jan 26, 2026Monday, 26 January 2026, 17:16	9.9 CRITICAL	—
Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
CVE-2025-70983 ↗	Jan 23, 2026Friday, 23 January 2026, 19:15	9.9 CRITICAL	—
Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.
CVE-2023-40788 ↗	Sep 19, 2023Tuesday, 19 September 2023, 00:15	5.3 MEDIUM	—
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs
CVE-2020-16165 ↗	Jul 30, 2020Thursday, 30 July 2020, 20:15	9.8 CRITICAL	7.5 HIGH
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters.