shuaijunlan/autumn

Autumn-Blog and Autumn-CMS

autumn's Issues

你这个项目的layui的css和js在哪啊

为什么我想自己写一个页面,我引用了我自己去下载的css和js文件,但是没有layui的效果

左侧菜单点击没反应

我添加了一个左侧菜单, 加载了一个loadJS, 然后数据库里填写了跳转的地址, html页面和.js也写好了,为什么点击不会跳转啊

autumn cms log has sensitive information Leakage

CMS log leak Current login user name and User permission information。

富文本编辑器

就是日志添加功能里的那个文本域, 后台接收不到值, 我看了他的api文档和你写的不一样啊,

autumn-cms system settings-menu management module has reflected XSS

The location of the reflected XSS vulnerability is in the first menu of the first module in the background
Enter my test payload <p/onMouseoVer=confirm7>4

Forgive me, a picture seems to be too big and cannot be uploaded

autumn-cms add user has XSS vulnerabilities

Location：cms后台登陆，系统设置->用户管理->添加用户->登录名

POC:登录名:<script>alert("hack123")</script>

后台代码未进行输入过滤：
@RequestMapping(value = "insert/")
@responsebody
public ResponseMsg insertUser(User user){

    user.setPassword(MD5Util.getMD5(user.getPassword()));
    return userService.insertUser(user);
}

你的富文本编辑器用的什么啊

我想了解增删改查

Infomation Unauthorized

Unauthorized status, you can get account password directly

http://localhost:8081/autumn-cms/user/getAllUser/?page=1&limit=10