CVE-2026-100192
6.5 MEDIUMpublic exploit availablePublished 2026-09-25 · Updated 2026-09-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-306
Public exploit & PoC references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py
- https://github.com/yzcheng90/X-SpringBoot
- https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64
All references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py
- https://github.com/yzcheng90/X-SpringBoot
- https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64
- https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100672PoC
- HIGHCVE-2026-100746PoC
- MEDIUMCVE-2026-100876PoC
- MEDIUMCVE-2026-100903PoC
- MEDIUMCVE-2026-101004
- CRITICALCVE-2026-101065PoC
- CRITICALCVE-2026-101077PoC
- HIGHCVE-2026-102245PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.