Jeecg Boot vulnerabilities, page 3

57 vulnerabilities

Known vulnerabilities in Jeecg Boot, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8HighCVE-2026-2822jeecg · jeecg_bootJeecgBoot Backend airag_app,1,create_by sql injectionA security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.EPSS0.55%7.5HighCVE-2026-2555jeecg · jeecg_bootJeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserializationA weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization. The attack can be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The project was informed of the problem early through an issue report but has not responded yet.EPSS0.66%8.8HighCVE-2026-1746jeecg · jeecg_bootJeecgBoot Online Report API loadDictItemByKeyword sql injectionA vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.EPSS0.50%9.8CriticalCVE-2023-40989jeecg · jeecg_boot +1 morejeecg jeecg_bootSQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.EPSS2.19%9.8CriticalCVE-2023-1784jeecg · jeecg_boot +1 morejeecg-boot API Documentation improper authenticationA vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699.EPSS1.00%9.8CriticalCVE-2023-1454jeecg · jeecg_boot +1 morejeecg-boot qurestSql sql injectionA vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.EPSS36.07%9.8CriticalCVE-2023-1741jeecg · jeecg_boot +1 morejeecg-boot Sleep Command SysDictMapper.java sql injectionA vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.EPSS0.82%9.8CriticalCVE-2023-41544jeecg · jeecg_boot +1 morejeecg jeecg_bootSSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.EPSS2.68%9.8CriticalCVE-2023-41543jeecg · jeecg_boot +1 morejeecg jeecg_bootSQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.EPSS0.93%7.5HighCVE-2023-41578jeecg · jeecg_boot +1 morejeecg jeecg_bootJeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.EPSS0.93%9.8CriticalCVE-2023-41542jeecg · jeecg_boot +1 morejeecg jeecg_bootSQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.EPSS0.86%6.5MediumCVE-2023-47467jeecg · jeecg_boot +1 morejeecg jeecg_bootDirectory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.EPSS1.14%9.8CriticalCVE-2023-42268jeecg · jeecg_boot +1 morejeecg jeecg_bootJeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.EPSS0.91%5.5MediumCVE-2023-38905jeecg · jeecg_boot +1 morejeecg jeecg_bootSQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.EPSS0.29%9.8CriticalCVE-2023-38992jeecg · jeecg_boot +1 morejeecg jeecg_bootjeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.EPSS73.40%6.5MediumCVE-2023-34660jeecg · jeecg_boot +1 morejeecg jeecg_bootjjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.EPSS0.64%9.8CriticalCVE-2023-34659jeecg · jeecg_boot +1 morejeecg jeecg_bootjeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.EPSS12.48%