Jeecg vulnerabilities, page 4
72 vulnerabilities
Known vulnerabilities in Jeecg products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
CVE-2023-47467jeecgjeecg_boot+1
EPSS score1.14%
Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.CVE-2023-42268jeecgjeecg_boot+1EPSS score0.91%
Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.CVE-2023-4450jeecgjimureport+1EPSS score11.59%
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.CVE-2023-38905jeecgjeecg_boot+1EPSS score0.29%
SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.CVE-2023-38992jeecgjeecg_boot+1EPSS score73.40%
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.CVE-2023-24789jeecgjeecg+1EPSS score0.84%
jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.CVE-2023-49442jeecgjeecgEPSS score38.55%
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.CVE-2023-6307jeecgjimureport+1EPSS score0.84%
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.CVE-2023-34603jeecgjeecgboot+1EPSS score0.69%
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.CVE-2023-34660jeecgjeecg_boot+1EPSS score0.64%
jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.CVE-2023-34659jeecgjeecg_boot+1EPSS score12.48%
jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.CVE-2023-34602jeecgjeecgboot+1EPSS score0.70%
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.