Jeecg vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-43028 A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP rCritical 9.8 · Apr 1, 2026
• CVE-2024-40489 There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on coCritical 9.8 · Apr 1, 2026
• CVE-2025-66913 JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs.Critical 9.8 · Jan 8, 2026
• CVE-2024-48307 JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.Critical 9.8 · Oct 30, 2024
• CVE-2024-44893 An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.Critical 9.8 · Sep 10, 2024
• CVE-2023-49442 Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.Critical 9.8 · Jan 3, 2024
• CVE-2023-41544 SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableDCritical 9.8 · Dec 29, 2023
• CVE-2023-41543 SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicaCritical 9.8 · Dec 29, 2023
• CVE-2023-41542 SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestCritical 9.8 · Dec 29, 2023
• CVE-2023-40989 SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecCritical 9.8 · Sep 22, 2023
• CVE-2023-42268 Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.Critical 9.8 · Sep 8, 2023
• CVE-2023-41578 Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.High 7.5 · Sep 8, 2023
• CVE-2023-38992 jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.Critical 9.8 · Jul 28, 2023
• CVE-2023-34603 JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SHigh 7.5 · Jun 19, 2023
• CVE-2023-34602 JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.High 7.5 · Jun 19, 2023
• CVE-2023-34659 jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.Critical 9.8 · Jun 16, 2023
• CVE-2023-24789 jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.High 8.8 · Mar 6, 2023
• CVE-2021-37306 An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: apHigh 7.5 · Feb 3, 2023
• CVE-2021-37305 An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sHigh 7.5 · Feb 3, 2023
• CVE-2021-37304 An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httHigh 7.5 · Feb 3, 2023
• CVE-2022-47105 Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.Critical 9.8 · Jan 19, 2023
• CVE-2022-45207 Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.Critical 9.8 · Nov 25, 2022
• CVE-2022-45206 Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.Critical 9.8 · Nov 25, 2022
• CVE-2022-22881 Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.Critical 9.8 · Feb 16, 2022
• CVE-2022-22880 Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.Critical 9.8 · Feb 16, 2022