Jeecg
Jeecg Boot: vulnerabilidades y CVE
Jeecg Boot tiene 57 vulnerabilidades publicadas, 17 de ellas en los últimos 12 meses. 21 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE57
Últimos 12 meses17
Críticas21
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-43028 | Crítica (9.8) | 1.5% | — | 1 abr 2026 | A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request. |
| CVE-2024-40489 | Crítica (9.8) | 0.52% | — | 1 abr 2026 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests. |
| CVE-2026-2945 | Baja (2.1) | 0.40% | — | 22 feb 2026 | A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the file /sys/common/uploadImgByHttp. Executing a manipulation of the argument fileUrl can lead to… |
| CVE-2026-2822 | Baja (2.1) | 0.49% | — | 20 feb 2026 | A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such… |
| CVE-2026-2555 | Baja (2.3) | 0.58% | — | 16 feb 2026 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component… |
| CVE-2026-2111 | Baja (2.1) | 0.55% | — | 7 feb 2026 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the component Retrieval-Augmented Generation Module. Executing a… |
| CVE-2026-1746 | Baja (2.1) | 0.50% | — | 2 feb 2026 | A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument… |
| CVE-2025-15126 | Baja (1.3) | 0.39% | — | 28 dic 2025 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId… |
| CVE-2025-15125 | Baja (1.3) | 0.31% | — | 28 dic 2025 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in… |
| CVE-2025-15124 | Baja (1.3) | 0.31% | — | 28 dic 2025 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization.… |
| CVE-2025-15123 | Baja (1.3) | 0.31% | — | 28 dic 2025 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to… |
| CVE-2025-15122 | Baja (1.3) | 0.31% | — | 28 dic 2025 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper… |
| CVE-2025-15121 | Media (4.8) | 0.41% | — | 28 dic 2025 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Such manipulation of the argument departId leads to… |
| CVE-2025-15120 | Baja (1.3) | 0.33% | — | 28 dic 2025 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The… |
| CVE-2025-15119 | Baja (1.3) | 0.28% | — | 28 dic 2025 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The… |
| CVE-2025-14909 | Baja (2.1) | 0.51% | — | 19 dic 2025 | A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file… |
| CVE-2025-14908 | Baja (2.1) | 0.35% | — | 19 dic 2025 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file… |
| CVE-2025-61189 | Media (6.3) | 0.26% | — | 1 oct 2025 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the… |
| CVE-2025-61188 | Media (6.3) | 0.26% | — | 1 oct 2025 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the… |
| CVE-2025-10981 | Baja (2.1) | 0.40% | — | 26 sept 2025 | A vulnerability was detected in JeecgBoot up to 3.8.2. This impacts an unknown function of the file /sys/tenant/exportXls. Performing manipulation results in improper authorization. The attack can be initiated remotely.… |
| CVE-2025-10980 | Baja (2.1) | 0.41% | — | 26 sept 2025 | A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation leads to improper authorization. It is possible to launch the… |
| CVE-2025-10979 | Baja (2.1) | 0.40% | — | 25 sept 2025 | A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes improper authorization. It is possible to initiate the… |
| CVE-2025-10978 | Baja (2.1) | 0.40% | — | 25 sept 2025 | A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filter Handler. The manipulation results in improper… |
| CVE-2025-10977 | Baja (1.3) | 0.39% | — | 25 sept 2025 | A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible… |
| CVE-2025-10976 | Baja (1.3) | 0.38% | — | 25 sept 2025 | A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization.… |
| CVE-2025-10707 | Baja (2.1) | 0.40% | — | 19 sept 2025 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The attack may be… |
| CVE-2025-10319 | Baja (2.1) | 0.33% | — | 12 sept 2025 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in… |
| CVE-2025-10318 | Baja (2.1) | 0.44% | — | 12 sept 2025 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of the component WebSocket Message Handler. The manipulation… |
| CVE-2025-4533 | Media (5.1) | 0.72% | — | 11 may 2025 | A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library… |
| CVE-2024-48307 | Crítica (9.8) | 44% | — | 31 oct 2024 | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.