CVE-2024-43028 | Critical | 9.8 | 2026-04-01 | A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP… |
CVE-2024-40489 | Critical | 9.8 | 2026-04-01 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on c… |
CVE-2026-2945 | Medium | 6.3 | 2026-02-22 | A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the file /sys/common/uploadImgByHttp. Executin… |
CVE-2026-2822 | Medium | 6.3 | 2026-02-20 | A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag… |
CVE-2026-2555 | Medium | 5.0 | 2026-02-16 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/contro… |
CVE-2026-2111 | Medium | 4.3 | 2026-02-07 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the comp… |
CVE-2026-1746 | Medium | 6.3 | 2026-02-02 | A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the componen… |
CVE-2025-66913 | Critical | 9.8 | 2026-01-08 | JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied… |
CVE-2025-15126 | Low | 3.1 | 2025-12-28 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositi… |
CVE-2025-15125 | Low | 3.1 | 2025-12-28 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission… |
CVE-2025-15124 | Low | 3.1 | 2025-12-28 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation… |
CVE-2025-15123 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulatio… |
CVE-2025-15122 | Low | 3.1 | 2025-12-28 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing mani… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2025-15120 | Low | 3.1 | 2025-12-28 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of t… |
CVE-2025-15119 | Low | 3.1 | 2025-12-28 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of t… |
CVE-2025-14909 | Medium | 4.3 | 2025-12-19 | A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-syste… |
CVE-2025-14908 | Medium | 6.3 | 2025-12-19 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
CVE-2025-61189 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers… |
CVE-2025-61188 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whiteliste… |
CVE-2025-10981 | Medium | 4.3 | 2025-09-26 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in i… |
CVE-2025-10980 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation le… |
CVE-2025-10979 | Medium | 4.3 | 2025-09-25 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes… |
CVE-2025-10978 | Medium | 4.3 | 2025-09-25 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filt… |
CVE-2025-10977 | Low | 3.1 | 2025-09-25 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument… |
CVE-2025-10976 | Low | 3.1 | 2025-09-25 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation… |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10319 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the com… |
CVE-2025-10318 | Medium | 6.3 | 2025-09-12 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of… |
CVE-2025-8963 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/te… |
CVE-2025-4533 | Low | 2.7 | 2025-05-11 | A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/k… |
CVE-2024-48307 | Critical | 9.8 | 2024-10-31 | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. |
CVE-2024-44893 | Critical | 9.8 | 2024-09-10 | An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request. |
CVE-2023-49442 | Critical | 9.8 | 2024-01-03 | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request. |
CVE-2023-41544 | Critical | 9.8 | 2023-12-30 | SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTable… |
CVE-2023-41543 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replic… |
CVE-2023-41542 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qures… |
CVE-2023-6307 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2023-47467 | Medium | 6.5 | 2023-11-22 | Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure. |
CVE-2023-40989 | Critical | 9.8 | 2023-09-22 | SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jee… |
CVE-2023-42268 | Critical | 9.8 | 2023-09-08 | Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show. |
CVE-2023-41578 | High | 7.5 | 2023-09-08 | Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection. |
CVE-2023-4450 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-38905 | Medium | 5.5 | 2023-08-17 | SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep… |
CVE-2023-38992 | Critical | 9.8 | 2023-07-28 | jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData. |
CVE-2023-34603 | High | 7.5 | 2023-06-19 | JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller… |
CVE-2023-34602 | High | 7.5 | 2023-06-19 | JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller… |
CVE-2023-34660 | Medium | 6.5 | 2023-06-16 | jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface. |
CVE-2023-34659 | Critical | 9.8 | 2023-06-16 | jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. |
CVE-2023-1784 | Medium | 5.3 | 2023-03-31 | A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The ma… |
CVE-2023-1741 | Medium | 4.3 | 2023-03-30 | A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysD… |
CVE-2023-1454 | Medium | 6.3 | 2023-03-17 | A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the… |
CVE-2023-24789 | High | 8.8 | 2023-03-06 | jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component. |
CVE-2021-37306 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: a… |
CVE-2021-37305 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /… |
CVE-2021-37304 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the ht… |
CVE-2022-47105 | Critical | 9.8 | 2023-01-19 | Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. |
CVE-2022-45210 | Medium | 4.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin. |
CVE-2022-45208 | Medium | 4.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin. |
CVE-2022-45207 | Critical | 9.8 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. |
CVE-2022-45206 | Critical | 9.8 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. |
CVE-2022-45205 | Medium | 5.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. |
CVE-2022-2647 | High | 7.3 | 2022-08-04 | A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the a… |
CVE-2021-44585 | Medium | 6.1 | 2022-03-10 | A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event. |
CVE-2022-22881 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. |
CVE-2022-22880 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. |
CVE-2021-46089 | Critical | 9.8 | 2022-01-25 | In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. |
CVE-2020-20948 | High | 7.5 | 2021-12-27 | An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable. |
CVE-2020-28088 | Critical | 9.8 | 2021-08-06 | An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code. |
CVE-2020-28087 | High | 7.5 | 2021-08-06 | A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information. |