VYPR
← All vendors
Vendor

Jeecg

Products
15
CVEs
102
Across products
112
Status
Private

Products

15

Recent CVEs

102
View all 102 CVEs →
  • CVE-2024-48307CriOct 31, 2024
    Jeecg
    Jeecgboot
    risk 0.67cvss 9.8epss 0.44

    JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.

  • CVE-2023-49442CriJan 3, 2024
    Jeecg
    JEECG
    risk 0.67cvss 9.8epss 0.39

    Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.

  • CVE-2023-34659CriJun 16, 2023
    Jeecg
    Jeecgboot
    risk 0.65cvss 9.8epss 0.12

    jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.

  • CVE-2024-43028CriApr 1, 2026
    Jeecg
    boot
    risk 0.64cvss 9.8epss 0.02

    A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request.

  • CVE-2024-40489CriApr 1, 2026
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.

  • CVE-2025-66913CriJan 8, 2026
    Jeecg
    Jimureport
    risk 0.64cvss 9.8epss 0.01

    JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different…

  • CVE-2024-50640CriAug 20, 2025
    Jeewx Boot
    jeewx-boot
    risk 0.64cvss 9.8epss 0.01

    jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function

  • CVE-2024-44893CriSep 10, 2024
    Jeecg
    Jimureport
    risk 0.64cvss 9.8epss 0.01

    An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.

  • CVE-2023-41544CriDec 30, 2023
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.03

    SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

  • CVE-2023-41543CriDec 30, 2023
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.

  • CVE-2023-41542CriDec 30, 2023
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

  • CVE-2023-42268CriSep 8, 2023
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.

  • CVE-2022-22881CriFeb 16, 2022
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.

  • CVE-2022-22880CriFeb 16, 2022
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.01

    Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.

  • CVE-2020-28088CriAug 6, 2021
    Jeecg
    Jeecgboot
    risk 0.64cvss 9.8epss 0.02

    An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.

  • CVE-2020-23083CriMay 3, 2021
    Jeecg
    JEECG
    risk 0.64cvss 9.8epss 0.04

    Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a crafted file to the component "jeecgFormDemoController.do?commonUpload".

  • CVE-2023-38992CriJul 28, 2023
    Jeecg
    Jeecgboot
    risk 0.63cvss 9.8epss 0.74

    jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

  • CVE-2026-36418CriJun 17, 2026
    Jeecg
    Jimureport
    risk 0.59cvss 9.1epss 0.00

    JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing…

  • CVE-2023-40989CriSep 22, 2023
    Jeecg
    Jeecgboot
    risk 0.57cvss 9.8epss 0.02

    SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

  • CVE-2023-24789HigMar 6, 2023
    Jeecg
    JEECG
    risk 0.57cvss 8.8epss 0.01

    jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.

View all 102 CVEs →