Winterchens My-Site vulnerabilities

CVE-2025-50904 [CRITICAL] CWE-288 CVE-2025-50904: There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06- There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token.

CVE-2025-8838 [CRITICAL] CWE-287 CVE-2025-8838: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8 A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to

CVE-2024-53496 [CRITICAL] CWE-284 CVE-2024-53496: Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to acce Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.

CVE-2024-57152 [HIGH] CWE-284 CVE-2024-57152: Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sens Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class

CVE-2024-53495 [HIGH] CWE-284 CVE-2024-53495: Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to acc Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.