JEECG Boot any version

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request.

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.

SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.

Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

jeecg-boot unrestricted upload

There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.

JeecgBoot Backend airag_app,1,create_by sql injection

JeecgBoot WebSocket Message sendWebSocketMsg improper authorization

JeecgBoot sendMsg improper authorization

JeecgBoot SysUserOnlineController.java SysUserOnlineController user session

JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication

Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.

JeecgBoot Document Library Upload zip unzipFile resource consumption

JeecgBoot getPositionUserList improper authorization

JeecgBoot exportXls improper authorization

JeecgBoot Filter exportXls improper authorization

JeecgBoot exportXls improper authorization

JeecgBoot exportXls improper authorization

JeecgBoot Tenant Log Export exportLog improper authorization

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.

JeecgBoot deleteBatch improper authorization

JeecgBoot getDepartUserList improper authorization

JeecgBoot getDeptRoleByUserId information disclosure

JeecgBoot Retrieval-Augmented Generation edit path traversal

JeecgBoot getDeptRoleList improper authorization

JeecgBoot datarule loadDatarule improper authorization

JeecgBoot datarule improper authorization

JeecgBoot list getParameterMap improper authorization

JeecgBoot queryDepartPermission improper authorization

JeecgBoot list queryPageList improper authorization