Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
173 results · page 3 of 4
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify glCVE-2026-108605 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A security vulnerability has been detected in JeecgBoot up to 3.9.3.CVE-2026-86228 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component.CVE-2026-78970 · Other software · reported by MITREMedium 6.5
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd.CVE-2026-82629 · Other software · jeecgboot · reported by VulDBLow 2
A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jeewx-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026JeecgBoot v3.9.2 is vulnerable to Remote command execution.CVE-2026-75411 · Other software · reported by MITRECritical 9.8
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate allCVE-2026-75479 · Other software · jeecgboot · reported by VulnCheckHigh 8.7
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.
- Product
- jimureport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat ModuleCVE-2026-67926 · Other software · reported by MITRECritical 9.8
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/uploadCVE-2026-67925 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was identified in JeecgBoot up to 3.9.2.CVE-2026-19000 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and dCVE-2026-58377 · Other software · jeecgboot · reported by VulnCheckHigh 8.6
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 30, 2026JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokCVE-2026-58375 · Other software · jeecgboot · reported by VulnCheckHigh 8.7
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.
- Product
- jimureport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 8, 2026A weakness has been identified in JeecgBoot up to 3.9.2.CVE-2026-11502 · Other software · reported by VulDBLow 1.3
A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdLoginController.java of the component Third-Party Login. This manipulation of the argument state causes open redirect. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The project replied: "After evaluation, this vulnerability has low exploitability in real-world scenarios: 1) Exploiting this vulnerability requires attackers to use social engineering techniques to induce victims to actively click on an OAuth login link constructed by the attacker; it cannot be triggered passively. 2) Third-party login (DingTalk/WeChat, etc.) is an optional feature and may not be enabled in most projects."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A vulnerability was identified in JeecgBoot up to 3.9.2.CVE-2026-11464 · Other software · reported by VulDBLow 1.3
A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modules\system\controller\SysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1.CVE-2026-10241 · Other software · jeecgboot · reported by VulDBLow 2.1
A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function FileDownloadUtils.download2DiskFromNet of the file /airag/app/debug of the component Cloud Instance Metadata Endpoint. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.9.2 mitigates this issue. It is suggested to upgrade the affected component.
- Product
- The server processes these URLs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A vulnerability was identified in JeecgBoot up to 3.9.2.CVE-2026-10240 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/airagModel/test. The manipulation of the argument baseUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A vulnerability was determined in JeecgBoot up to 3.9.2.CVE-2026-10239 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. A fix is planned for the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability was detected in JeecgBoot up to 3.9.1.CVE-2026-9604 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the argument list/queryById results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 3.9.2 is able to resolve this issue. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability was identified in JeecgBoot up to 3.9.1.CVE-2026-9581 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability was determined in JeecgBoot up to 3.9.1.CVE-2026-9580 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/selectDepart. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is sufficient to fix this issue. It is suggested to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability was found in JeecgBoot up to 3.9.1.CVE-2026-9579 · Other software · reported by VulDBLow 2.1
A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2026A vulnerability has been found in JeecgBoot 3.9.1.CVE-2026-9373 · Other software · reported by VulDBMedium 6.3
A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Such manipulation leads to improper authentication. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026A flaw has been found in JeecgBoot 3.9.1.CVE-2026-8196 · Other software · reported by VulDBLow 2.9
A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026A vulnerability was detected in JeecgBoot up to 3.9.1.CVE-2026-8195 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A vulnerability was identified in JeecgBoot up to 3.9.1.CVE-2026-8114 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the component JSON Object Handler. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor confirms (translated from Chinese): "It should have been fixed; a batch of issues were recently resolved."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A security flaw has been discovered in JeecgBoot up to 3.9.1.CVE-2026-7605 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMultipartFile/HttpFileToMultipartFileUtil.downloadImageData of the file CommonController.java of the component uploadImgByHttpEndpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading the affected component is recommended. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A vulnerability was identified in JeecgBoot up to 3.9.1.CVE-2026-7604 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A vulnerability was determined in JeecgBoot up to 3.9.1.CVE-2026-7603 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of the component LoadFile Endpoint. This manipulation of the argument files causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A vulnerability was found in JeecgBoot up to 3.9.1.CVE-2026-7602 · Other software · reported by VulDBLow 2.1
A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component FillRuleUtil Component. The manipulation of the argument ruleClass results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. You should upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was determined in JeecgBoot up to 3.9.1.CVE-2026-7290 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A vulnerability has been found in JeecgBoot up to 3.9.1.CVE-2026-5999 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A vulnerability was found in jeecgboot JimuReport up to 2.3.0.CVE-2026-5848 · Other software · jeecgboot · reported by VulDBLow 2
A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source Handler. Performing a manipulation of the argument dbUrl results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
- Product
- JimuReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1.CVE-2026-5616 · Other software · reported by VulDBMedium 6.9
A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability has been found in JeecgBoot up to 3.9.1.CVE-2026-3672 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such manipulation leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A weakness has been identified in JeecgBoot 3.9.0.CVE-2026-2945 · Other software · Jeecg · reported by VulDBLow 2.1
A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the file /sys/common/uploadImgByHttp. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A security vulnerability has been detected in JeecgBoot up to 3.9.1.CVE-2026-2822 · Other software · Jeecg · reported by VulDBLow 2.1
A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A weakness has been identified in JeecgBoot 3.9.1.CVE-2026-2555 · Other software · Jeecg · reported by VulDBLow 2.3
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization. The attack can be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A weakness has been identified in JeecgBoot up to 3.9.0.CVE-2026-2111 · Other software · Jeecg · reported by VulDBLow 2.1
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the component Retrieval-Augmented Generation Module. Executing a manipulation of the argument filePath can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026A vulnerability was identified in JeecgBoot 3.9.0.CVE-2026-1746 · Other software · Jeecg · reported by VulDBLow 2.1
A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A weakness has been identified in JeecgBoot up to 3.9.0.CVE-2025-15126 · Other software · Jeecg · reported by VulDBLow 1.3
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A security flaw has been discovered in JeecgBoot up to 3.9.0.CVE-2025-15125 · Other software · Jeecg · reported by VulDBLow 1.3
A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was identified in JeecgBoot up to 3.9.0.CVE-2025-15124 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was determined in JeecgBoot up to 3.9.0.CVE-2025-15123 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was found in JeecgBoot up to 3.9.0.CVE-2025-15122 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability has been found in JeecgBoot up to 3.9.0.CVE-2025-15121 · Other software · Jeecg · reported by VulDBMedium 4.8
A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Such manipulation of the argument departId leads to information disclosure. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A flaw has been found in JeecgBoot up to 3.9.0.CVE-2025-15120 · Other software · Jeecg · reported by VulDBLow 1.3
A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2025A vulnerability was detected in JeecgBoot up to 3.9.0.CVE-2025-15119 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025A weakness has been identified in JeecgBoot up to 3.9.0.CVE-2025-14909 · Other software · Jeecg · reported by VulDBLow 2.1
A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025A security flaw has been discovered in JeecgBoot up to 3.9.0.CVE-2025-14908 · Other software · Jeecg · reported by VulDBLow 2.1
A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Multi-Tenant Management Module. Performing manipulation of the argument ID results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee. It is recommended to apply a patch to fix this issue.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd.CVE-2025-12626 · Other software · jeecgboot · reported by VulDBLow 2.1
A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding.
- Product
- jeewx-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability.CVE-2025-61189 · Other software · Jeecg · reported by MITREMedium 6.3
Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.