Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 48

Export CSV
CVE-2026-126998

JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery

A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecgboot
Products
Jeecgboot
CVE-2026-126997

JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecgboot
Products
Jeecgboot
CVE-2026-124554

JeecgBoot JimuBI getAllChartData sql injection

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecgboot Jeecgboot
CVE-2026-124555

JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection

A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecgboot Jeecgboot
CVE-2026-112017

JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg Boot Jeecgboot Jeecgboot
CVE-2026-108647

JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108637

JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108622

JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen sys_log records to erase traces of their actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108617

JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg Boot Jeecgboot
CVE-2026-108885

JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys_sms row, erasing records of sent notifications without ownership checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108880

JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's low_app_id, obtained from GET /sys/dict/list, via the lowAppId parameter or X-Low-App-ID header to rename dictionaries and replace their items.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg Boot Jeecgboot
CVE-2026-108870

JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level filters to widen readable records or altering filtering for other roles.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108680

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108670

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108650

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108645

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108625

JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108638

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108608

JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot
CVE-2026-108661

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jeecg Jeecgboot
Products
Jeecg-boot Jeecg Boot Jeecgboot