critical9.8
CVE-2025-29085
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
Impact
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vip.saturn:saturn-console | <= 3.5.1 | none recorded |