Is there a public PoC exploit available for CVE-2026-11464?

Yes, a public proof-of-concept exploit is available for CVE-2026-11464. Prioritise patching immediately. EPSS: 0.0%.

JeecgBoot CVE-2026-11464

Q: What is the CVSS score of CVE-2026-11464?

CVE-2026-11464 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34995 LOW

Information Exposure (CWE-200)

2026-06-07 VulDB

GHSA-g4g6-g3hx-2f5w

Java Information Disclosure N A Jeecgboot

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 07, 2026 - 23:22 NVD

3.1 (LOW) 1.3 (LOW)

Analysis Generated

Jun 07, 2026 - 22:58 vuln.today

DescriptionCVE.org

A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modules\system\controller\SysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

AnalysisAI

Information disclosure in JeecgBoot up to 3.9.2 allows authenticated remote attackers to extract password salt values by manipulating the salt argument in the queryPageList function of the User List Endpoint (SysUserController.java). While the CVSS score is low (3.1) due to high attack complexity and a low-privilege authentication requirement, a publicly available proof-of-concept (GitHub issue #9648) exists and no vendor patch has been released - only one planned for a future version. Exposure of salt values is particularly sensitive as it can facilitate offline password hash cracking if hashes are separately obtained.

Technical ContextAI

JeecgBoot is a Java-based low-code rapid development platform. The vulnerability resides in src\main\java\org\jeecg\modules\system\controller\SysUserController.java, specifically within the queryPageList function responsible for paginated user listing. The salt parameter - typically a per-user random value used in credential hashing - is improperly exposed in API query responses when manipulated by an authenticated caller. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as insufficient output filtering or access control on sensitive credential metadata returned by this endpoint. The CPE identifier cpe:2.3:a:n/a:jeecgboot:*:*:*:*:*:*:*:* covers all versions through 3.9.2. The vendor CPE namespace is listed as 'n/a', indicating no formal NVD vendor assignment at the time of reporting.

RemediationAI

No vendor-released patch is available at the time of analysis; a fix is planned for an upcoming JeecgBoot release. Monitor the official repository at https://github.com/jeecgboot/JeecgBoot/ and the tracking issue at https://github.com/jeecgboot/JeecgBoot/issues/9648 for the patched version. As an immediate compensating control, restrict network access to the User List Endpoint (/sys/user/queryPageList) via firewall rules or application-layer access controls so only trusted administrative roles can invoke it - this reduces the pool of potential authenticated attackers, though it does not eliminate the vulnerability. Additionally, audit API response schemas for this endpoint to strip or mask salt fields before they reach clients, which directly neutralizes the disclosure vector without requiring a code patch. Upgrading to the vendor-released fix once available remains the definitive remediation.