Jeewms
by Jeewms
CVEs (29)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-53499 | Cri | 0.64 | 9.8 | 0.01 | Aug 22, 2025 | Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. | ||
| CVE-2025-50901 | Cri | 0.64 | 9.8 | 0.00 | Aug 20, 2025 | JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. | ||
| CVE-2024-27764 | Cri | 0.64 | 9.8 | 0.01 | Mar 5, 2024 | An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. | ||
| CVE-2025-60269 | Cri | 0.61 | 9.4 | 0.00 | Oct 10, 2025 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file. | ||
| CVE-2024-57761 | Hig | 0.53 | 8.1 | 0.00 | Jan 15, 2025 | An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file. | ||
| CVE-2024-57757 | Hig | 0.49 | 7.5 | 0.00 | Jan 15, 2025 | JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. | ||
| CVE-2024-27765 | Hig | 0.49 | 7.5 | 0.01 | Mar 5, 2024 | Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component. | ||
| CVE-2026-3026 | Hig | 0.47 | 7.3 | 0.00 | Feb 23, 2026 | A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack… | ||
| CVE-2025-70311 | Med | 0.42 | 6.5 | 0.00 | Feb 3, 2026 | JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface for attack. | ||
| CVE-2025-60268 | Med | 0.42 | 6.5 | 0.00 | Oct 10, 2025 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code… | ||
| CVE-2024-57760 | Med | 0.42 | 6.5 | 0.00 | Jan 15, 2025 | JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java. | ||
| CVE-2025-5390 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the… | ||
| CVE-2025-5389 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access… | ||
| CVE-2025-5388 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes… | ||
| CVE-2025-5387 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the… | ||
| CVE-2025-5386 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransController.do?transEditor. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not… | ||
| CVE-2025-5385 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplateController.do?doAdd. The manipulation leads to path traversal. The attack can be initiated remotely. Continious delivery… | ||
| CVE-2025-5384 | Med | 0.41 | 6.3 | 0.00 | May 31, 2025 | A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListController.do?datagrid. The manipulation leads to sql injection. It is possible to initiate the attack remotely. This… | ||
| CVE-2025-0392 | Med | 0.41 | 6.3 | 0.01 | Jan 11, 2025 | A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is… | ||
| CVE-2025-0391 | Med | 0.41 | 6.3 | 0.01 | Jan 11, 2025 | A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The… |
- risk 0.64cvss 9.8epss 0.01
Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.
- risk 0.64cvss 9.8epss 0.00
JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
- risk 0.64cvss 9.8epss 0.01
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.
- risk 0.61cvss 9.4epss 0.00
JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.
- risk 0.53cvss 8.1epss 0.00
An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file.
- risk 0.49cvss 7.5epss 0.00
JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.
- risk 0.49cvss 7.5epss 0.01
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component.
- risk 0.47cvss 7.3epss 0.00
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack…
- risk 0.42cvss 6.5epss 0.00
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface for attack.
- risk 0.42cvss 6.5epss 0.00
An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code…
- risk 0.42cvss 6.5epss 0.00
JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.
- risk 0.41cvss 6.3epss 0.00
A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the…
- risk 0.41cvss 6.3epss 0.00
A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access…
- risk 0.41cvss 6.3epss 0.00
A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes…
- risk 0.41cvss 6.3epss 0.00
A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the…
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransController.do?transEditor. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not…
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplateController.do?doAdd. The manipulation leads to path traversal. The attack can be initiated remotely. Continious delivery…
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListController.do?datagrid. The manipulation leads to sql injection. It is possible to initiate the attack remotely. This…
- risk 0.41cvss 6.3epss 0.01
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is…
- risk 0.41cvss 6.3epss 0.01
A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The…
Page 1 of 2