Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Apr 30, 2026An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute CVE-2026-36762 · Other software · reported by MITREHigh 8.8
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrary web scripts or HTMCVE-2026-36761 · Other software · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the msgContent parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a patCVE-2026-36760 · Other software · reported by MITRECritical 9.6
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability has been found in thinkgem JeeSite up to 5.15.1.CVE-2026-3405 · Other software · thinkgem · reported by VulDBLow 1.3
A vulnerability has been found in thinkgem JeeSite up to 5.15.1. The affected element is an unknown function of the component Connection Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A flaw has been found in thinkgem JeeSite up to 5.15.1.CVE-2026-3404 · Other software · thinkgem · reported by VulDBLow 1.3
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was found in thinkgem JeeSite up to 5.12.1.CVE-2025-9796 · Other software · thinkgem · reported by VulDBLow 2
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7865 · Other software · thinkgem · reported by VulDBLow 2
A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3585737d21fe490ff6948d913fcbd8d99c41fc08. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2025A vulnerability was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7864 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3585737d21fe490ff6948d913fcbd8d99c41fc08. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2025A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic.CVE-2025-7863 · Other software · thinkgem · reported by VulDBMedium 5.1
A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be launched remotely. The name of the patch is 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7785 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com/jeesite/modules/sys/web/SsoController.java. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7763 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability was identified in thinkgem JeeSite up to 5.12.0.CVE-2025-7759 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in thinkgem JeeSite up to 5.11.1.CVE-2025-5186 · Other software · thinkgem · reported by VulDBMedium 5.3
A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024A vulnerability was found in thinkgem JeeSite 5.3.CVE-2024-8112 · Other software · thinkgem · reported by VulDBMedium 6.9
A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the component Cookie Handler. The manipulation of the argument skinName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the AdmCVE-2023-38991 · Other software · Jeesite · reported by MITREMedium 5.4
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the AdministCVE-2023-38990 · Other software · Jeesite · reported by MITREMedium 4.3
An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role infoCVE-2023-38989 · Other software · Jeesite · reported by MITREMedium 4.3
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by CVE-2023-38988 · Other software · Jeesite · reported by MITREMedium 4.3
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.CVE-2023-34601 · Other software · Jeesite · reported by MITRECritical 9.8
Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437.CVE-2020-19229 · Other software · Jeesite · reported by MITRECritical 9.8
Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2019Jeesite 1.2.7 is affected by: SQL Injection.CVE-2019-1010201 · Other software · Jeesite · reported by josh@bress.netMedium 6.5
Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The attack vector is: network connectivity,authenticated. The fixed version is: 4.0 and later.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2019Jeesite 1.2.7 is affected by: XML External Entity (XXE).CVE-2019-1010202 · Other software · Jeesite · reported by josh@bress.netMedium 6.5
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.