Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by iFlytek
CVE-2026-95930 (GCVE-0-2026-95930)
Vulnerability from nvd – Published: 2026-09-23 02:15 – Updated: 2026-09-23 14:54 X_Open Source
VLAI
EPSS
VEX
Title
iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
Summary
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:53 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408552 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408552/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95930 | third-party-advisory |
| https://vuldb.com/submit/953331 | third-party-advisory |
| https://github.com/iflytek/astron-agent/issues/1323 | issue-tracking |
| https://github.com/iflytek/astron-agent/pull/1338 | issue-trackingpatch |
| https://github.com/iflytek/astron-agent/commit/45… | patch |
| https://github.com/iflytek/astron-agent/releases/… | patch |
| https://github.com/iflytek/astron-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iFlytek | astron-agent |
Affected:
1.0.0
Affected: 1.0.1 Affected: 1.0.2 Affected: 1.0.3 Affected: 1.0.4 Affected: 1.0.5 Affected: 1.0.6 Unaffected: reward-1575 cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95930",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:53:43.906117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:54:28.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/iflytek/astron-agent/issues/1323"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"debugToolV2 API endpoint"
],
"product": "astron-agent",
"vendor": "iFlytek",
"versions": [
{
"status": "affected",
"version": "1.0.0"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.2"
},
{
"status": "affected",
"version": "1.0.3"
},
{
"status": "affected",
"version": "1.0.4"
},
{
"status": "affected",
"version": "1.0.5"
},
{
"status": "affected",
"version": "1.0.6"
},
{
"status": "unaffected",
"version": "reward-1575"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T-Chachamaru (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:15:20.083Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408552 | iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408552"
},
{
"name": "VDB-408552 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408552/cti"
},
{
"name": "CVE-2026-95930 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95930"
},
{
"name": "Submit #953331 | iFlytek astron-agent 1.0.6 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953331"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1323"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/iflytek/astron-agent/pull/1338"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e4540bbb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/releases/tag/reward-1575"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:28:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95930",
"datePublished": "2026-09-23T02:15:20.083Z",
"dateReserved": "2026-09-22T17:23:02.218Z",
"dateUpdated": "2026-09-23T14:54:28.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95929 (GCVE-0-2026-95929)
Vulnerability from nvd – Published: 2026-09-23 02:00 – Updated: 2026-09-23 02:00 X_Open Source
VLAI
EPSS
VEX
Title
iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection
Summary
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component.
Severity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408551 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408551/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95929 | third-party-advisory |
| https://vuldb.com/submit/953330 | third-party-advisory |
| https://github.com/iflytek/astron-agent/issues/1329 | issue-tracking |
| https://github.com/iflytek/astron-agent/pull/1342 | issue-trackingpatch |
| https://github.com/iflytek/astron-agent/commit/67… | patch |
| https://github.com/iflytek/astron-agent/releases/… | patch |
| https://github.com/iflytek/astron-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iFlytek | astron-agent |
Affected:
1.0.0
Affected: 1.0.1 Affected: 1.0.2 Affected: 1.0.3 Affected: 1.0.4 Affected: 1.0.5 Affected: 1.0.6 Affected: 1.0.7 Unaffected: reward-1575 cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"getBotList API endpoint"
],
"product": "astron-agent",
"vendor": "iFlytek",
"versions": [
{
"status": "affected",
"version": "1.0.0"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.2"
},
{
"status": "affected",
"version": "1.0.3"
},
{
"status": "affected",
"version": "1.0.4"
},
{
"status": "affected",
"version": "1.0.5"
},
{
"status": "affected",
"version": "1.0.6"
},
{
"status": "affected",
"version": "1.0.7"
},
{
"status": "unaffected",
"version": "reward-1575"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T-Chachamaru (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:00:12.847Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408551 | iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408551"
},
{
"name": "VDB-408551 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408551/cti"
},
{
"name": "CVE-2026-95929 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95929"
},
{
"name": "Submit #953330 | iFlytek astron-agent 1.0.7 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953330"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1329"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/iflytek/astron-agent/pull/1342"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/commit/6702be70ae802b1048f5fbec91e690e7b71a4165"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/releases/tag/reward-1575"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:28:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95929",
"datePublished": "2026-09-23T02:00:12.847Z",
"dateReserved": "2026-09-22T17:22:58.752Z",
"dateUpdated": "2026-09-23T02:00:12.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82475 (GCVE-0-2026-82475)
Vulnerability from nvd – Published: 2026-08-29 16:35 – Updated: 2026-09-01 02:14
VLAI
EPSS
VEX
Title
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
Summary
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 02:14 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/iflytek/astron-agent/issues/1590 | issue-tracking |
| https://github.com/iflytek/astron-agent/blob/v1.1… | technical-description |
| https://github.com/iflytek/astron-agent | product |
| https://www.vulncheck.com/advisories/iflytek-astr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iflytek | astron-agent |
Affected:
0 , ≤ 1.1.1
(custom)
|
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82475",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T02:14:11.626329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:14:34.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/iflytek/astron-agent/issues/1590"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "astron-agent",
"vendor": "iflytek",
"versions": [
{
"lessThanOrEqual": "1.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants\u0027 workflows or copy private workflows to read their definitions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T16:35:34.514Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1590",
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1590"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent"
},
{
"name": "VulnCheck Advisory: iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.1-workflow-hijacking-via-missing-ownership-check"
}
],
"title": "iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82475",
"datePublished": "2026-08-29T16:35:34.514Z",
"dateReserved": "2026-08-29T14:11:14.664Z",
"dateUpdated": "2026-09-01T02:14:34.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95930 (GCVE-0-2026-95930)
Vulnerability from cvelistv5 – Published: 2026-09-23 02:15 – Updated: 2026-09-23 14:54 X_Open Source
VLAI
EPSS
VEX
Title
iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
Summary
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:53 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408552 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408552/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95930 | third-party-advisory |
| https://vuldb.com/submit/953331 | third-party-advisory |
| https://github.com/iflytek/astron-agent/issues/1323 | issue-tracking |
| https://github.com/iflytek/astron-agent/pull/1338 | issue-trackingpatch |
| https://github.com/iflytek/astron-agent/commit/45… | patch |
| https://github.com/iflytek/astron-agent/releases/… | patch |
| https://github.com/iflytek/astron-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iFlytek | astron-agent |
Affected:
1.0.0
Affected: 1.0.1 Affected: 1.0.2 Affected: 1.0.3 Affected: 1.0.4 Affected: 1.0.5 Affected: 1.0.6 Unaffected: reward-1575 cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95930",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:53:43.906117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:54:28.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/iflytek/astron-agent/issues/1323"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"debugToolV2 API endpoint"
],
"product": "astron-agent",
"vendor": "iFlytek",
"versions": [
{
"status": "affected",
"version": "1.0.0"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.2"
},
{
"status": "affected",
"version": "1.0.3"
},
{
"status": "affected",
"version": "1.0.4"
},
{
"status": "affected",
"version": "1.0.5"
},
{
"status": "affected",
"version": "1.0.6"
},
{
"status": "unaffected",
"version": "reward-1575"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T-Chachamaru (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:15:20.083Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408552 | iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408552"
},
{
"name": "VDB-408552 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408552/cti"
},
{
"name": "CVE-2026-95930 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95930"
},
{
"name": "Submit #953331 | iFlytek astron-agent 1.0.6 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953331"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1323"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/iflytek/astron-agent/pull/1338"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e4540bbb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/releases/tag/reward-1575"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:28:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95930",
"datePublished": "2026-09-23T02:15:20.083Z",
"dateReserved": "2026-09-22T17:23:02.218Z",
"dateUpdated": "2026-09-23T14:54:28.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95929 (GCVE-0-2026-95929)
Vulnerability from cvelistv5 – Published: 2026-09-23 02:00 – Updated: 2026-09-23 02:00 X_Open Source
VLAI
EPSS
VEX
Title
iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection
Summary
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component.
Severity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408551 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408551/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-95929 | third-party-advisory |
| https://vuldb.com/submit/953330 | third-party-advisory |
| https://github.com/iflytek/astron-agent/issues/1329 | issue-tracking |
| https://github.com/iflytek/astron-agent/pull/1342 | issue-trackingpatch |
| https://github.com/iflytek/astron-agent/commit/67… | patch |
| https://github.com/iflytek/astron-agent/releases/… | patch |
| https://github.com/iflytek/astron-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iFlytek | astron-agent |
Affected:
1.0.0
Affected: 1.0.1 Affected: 1.0.2 Affected: 1.0.3 Affected: 1.0.4 Affected: 1.0.5 Affected: 1.0.6 Affected: 1.0.7 Unaffected: reward-1575 cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"getBotList API endpoint"
],
"product": "astron-agent",
"vendor": "iFlytek",
"versions": [
{
"status": "affected",
"version": "1.0.0"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.2"
},
{
"status": "affected",
"version": "1.0.3"
},
{
"status": "affected",
"version": "1.0.4"
},
{
"status": "affected",
"version": "1.0.5"
},
{
"status": "affected",
"version": "1.0.6"
},
{
"status": "affected",
"version": "1.0.7"
},
{
"status": "unaffected",
"version": "reward-1575"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T-Chachamaru (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:00:12.847Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408551 | iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408551"
},
{
"name": "VDB-408551 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408551/cti"
},
{
"name": "CVE-2026-95929 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-95929"
},
{
"name": "Submit #953330 | iFlytek astron-agent 1.0.7 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/953330"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1329"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/iflytek/astron-agent/pull/1342"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/commit/6702be70ae802b1048f5fbec91e690e7b71a4165"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iflytek/astron-agent/releases/tag/reward-1575"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-22T19:28:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-95929",
"datePublished": "2026-09-23T02:00:12.847Z",
"dateReserved": "2026-09-22T17:22:58.752Z",
"dateUpdated": "2026-09-23T02:00:12.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82475 (GCVE-0-2026-82475)
Vulnerability from cvelistv5 – Published: 2026-08-29 16:35 – Updated: 2026-09-01 02:14
VLAI
EPSS
VEX
Title
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
Summary
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 02:14 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/iflytek/astron-agent/issues/1590 | issue-tracking |
| https://github.com/iflytek/astron-agent/blob/v1.1… | technical-description |
| https://github.com/iflytek/astron-agent | product |
| https://www.vulncheck.com/advisories/iflytek-astr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iflytek | astron-agent |
Affected:
0 , ≤ 1.1.1
(custom)
|
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82475",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T02:14:11.626329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:14:34.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/iflytek/astron-agent/issues/1590"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "astron-agent",
"vendor": "iflytek",
"versions": [
{
"lessThanOrEqual": "1.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants\u0027 workflows or copy private workflows to read their definitions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T16:35:34.514Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1590",
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-agent/issues/1590"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-agent"
},
{
"name": "VulnCheck Advisory: iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.1-workflow-hijacking-via-missing-ownership-check"
}
],
"title": "iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82475",
"datePublished": "2026-08-29T16:35:34.514Z",
"dateReserved": "2026-08-29T14:11:14.664Z",
"dateUpdated": "2026-09-01T02:14:34.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}