Jeecgboot
Monthly
Unauthenticated access to JimuReport's report folder template listing endpoint exposes all report definitions, share tokens, embedded SQL statements, and live query data to any remote attacker. The CWE-306 root cause - missing authentication for a critical function - means the disclosure requires no credentials, no user interaction, and no special tooling. With a CVSS 4.0 score of 8.7 and a network-accessible, zero-complexity attack path, this represents a high-priority information disclosure risk for any JimuReport deployment reachable from an untrusted network. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability is fully disclosed via VulnCheck advisory and a public GitHub issue.
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController and OpenApiPermissionController endpoints, which are missing Shiro authorization annotations, to fully manage OpenAPI AK/SK credentials. Because the list endpoint returns secret keys in plaintext, any logged-in user can harvest every Access Key/Secret Key pair and then create, modify, or delete them, enabling credential theft and unauthorized invocation of the OpenAPI surface. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export the full contents of any report via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, JimuReportTokenInterceptor skips all authentication and the export service never checks the auto-export configuration flag, so any guessed report id is rendered and streamed back. Publicly available exploit code exists; the disclosure comes from VulnCheck and the CVSS 4.0 base score is 8.7 (High), driven by high confidentiality impact with no privileges or user interaction required.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote attackers a direct path to make the application server issue arbitrary HTTP requests to internal or external network resources. All versions up to and including 3.9.2 are affected, with the flaw residing in the Anonymous Chat Attachment Parser component - meaning no login is required to trigger it. Public exploit code exists via a GitHub issue (no public exploit identified as actively exploited per CISA KEV), and no vendor-released patch is available at time of analysis.
Open redirect in JeecgBoot's ThirdLoginController (versions 3.9.0-3.9.2) allows remote attackers to manipulate the OAuth `state` parameter and redirect victims to attacker-controlled URLs via the third-party login flow. The vendor's own assessment confirms low real-world exploitability: successful exploitation requires social engineering to induce victims into clicking a crafted OAuth login link, and the affected third-party login feature (DingTalk, WeChat) is optional and likely disabled in most deployments. Publicly available exploit code exists, but no KEV listing indicates active exploitation campaigns at time of analysis.
Information disclosure in JeecgBoot up to 3.9.2 allows authenticated remote attackers to extract password salt values by manipulating the `salt` argument in the `queryPageList` function of the User List Endpoint (`SysUserController.java`). While the CVSS score is low (3.1) due to high attack complexity and a low-privilege authentication requirement, a publicly available proof-of-concept (GitHub issue #9648) exists and no vendor patch has been released - only one planned for a future version. Exposure of salt values is particularly sensitive as it can facilitate offline password hash cracking if hashes are separately obtained.
Improper access control in JeecgBoot's AiragModelController (versions up to 3.9.1) permits any authenticated low-privilege user to invoke the list and queryById API endpoints without proper authorization checks, exposing AI RAG model configuration data restricted to higher-privileged roles. The CVSS vector (PR:L, C:L) confirms this is an authorization bypass rather than a full authentication bypass, limiting impact to confidentiality of AI model metadata. Publicly available exploit code exists (GitHub issue #9599, referenced in the exploit tag), though no CISA KEV listing indicates confirmed widespread active exploitation at time of analysis.
Improper access control in JeecgBoot through version 3.9.1 exposes the LoginController.selectDepart endpoint at /sys/selectDepart, allowing remote attackers to bypass authorization checks tied to department/tenant selection during login. Publicly available exploit code exists per VulDB disclosure, and the vendor has shipped a fix in v3.9.2. No active in-the-wild exploitation has been confirmed (not in CISA KEV), but the public POC and network-reachable attack surface make opportunistic abuse plausible.
Improper access control in JeecgBoot versions up to 3.9.1 allows authenticated low-privileged remote attackers to bypass authorization checks by manipulating the `userIdentity` argument in the SysUser component's `user.getUsername` function at the `/sys/user/login/setting/userEdit` endpoint. A publicly available proof-of-concept exploit exists via GitHub issue #9596, increasing practical risk for any multi-user JeecgBoot deployment where adversaries hold a low-privileged account. Vendor-released patch v3.9.2 is available and explicitly remediates this access control failure alongside several other high-severity issues including RCE and SSRF, indicating a broad security hardening effort in this release cycle.
Improper authentication in JeecgBoot 3.9.1 OpenAPI endpoint allows remote attackers to bypass authentication checks and perform unauthorized actions, though exploitation is rated difficult due to high attack complexity. No public exploit code has been identified and no vendor response has been received. With CVSS 3.7 (Low severity) and AV:N/AC:H/PR:N parameters, the vulnerability poses limited immediate risk but requires monitoring given the authentication bypass nature and remote attack vector.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Server-side request forgery in JeecgBoot up to 3.9.1 allows authenticated remote attackers to manipulate the CommonController.uploadImgByHttp endpoint and trigger arbitrary HTTP requests from the server, with publicly available exploit code and vendor confirmation of the issue. The vulnerability affects the image upload functionality through HttpFileToMultipartFileUtil.httpFileToMultipartFile and downloadImageData methods, enabling attackers with valid credentials to abuse the application as a proxy for outbound requests.
SQL injection in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to execute arbitrary SQL commands through the loadDict endpoint by manipulating the keyword parameter in the SqlInjectionUtil function. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector, and publicly available exploit code exists; patch availability is confirmed via GitHub commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b.
Improper authorization in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to bypass access controls in the SysAnnouncementController component, potentially leading to unauthorized data modification and disclosure. The vulnerability has a CVSS score of 6.3 (medium severity) and carries an EPSS severity rating reflecting real-world exploitability; publicly available exploit code exists and the vendor has confirmed the issue with a patch expected in an upcoming release.
Code injection in JimuReport's Data Source Handler allows authenticated high-privilege users to execute arbitrary code via manipulated dbUrl parameters in the DriverManager.getConnection function (versions up to 2.3.0). The vulnerability requires high-privilege authentication but can be exploited remotely with low attack complexity; publicly available exploit code exists and the vendor has acknowledged the issue with a fix planned for an upcoming release.
Missing authentication in JeecgBoot 3.9.0 and 3.9.1 allows unauthenticated remote attackers to access the AI Chat Module functionality without credential verification. The vulnerability resides in JeecgBizToolsProvider.java within the jeecg-module-system component. Vendor-released patches are available via GitHub commits (b7c9aeba and 2c1cc88b) pending inclusion in the next official release. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and network attack vector (AV:N) with no authentication required (PR:N) indicate trivial exploitation potential.
JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated access to JimuReport's report folder template listing endpoint exposes all report definitions, share tokens, embedded SQL statements, and live query data to any remote attacker. The CWE-306 root cause - missing authentication for a critical function - means the disclosure requires no credentials, no user interaction, and no special tooling. With a CVSS 4.0 score of 8.7 and a network-accessible, zero-complexity attack path, this represents a high-priority information disclosure risk for any JimuReport deployment reachable from an untrusted network. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability is fully disclosed via VulnCheck advisory and a public GitHub issue.
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController and OpenApiPermissionController endpoints, which are missing Shiro authorization annotations, to fully manage OpenAPI AK/SK credentials. Because the list endpoint returns secret keys in plaintext, any logged-in user can harvest every Access Key/Secret Key pair and then create, modify, or delete them, enabling credential theft and unauthorized invocation of the OpenAPI surface. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export the full contents of any report via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, JimuReportTokenInterceptor skips all authentication and the export service never checks the auto-export configuration flag, so any guessed report id is rendered and streamed back. Publicly available exploit code exists; the disclosure comes from VulnCheck and the CVSS 4.0 base score is 8.7 (High), driven by high confidentiality impact with no privileges or user interaction required.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote attackers a direct path to make the application server issue arbitrary HTTP requests to internal or external network resources. All versions up to and including 3.9.2 are affected, with the flaw residing in the Anonymous Chat Attachment Parser component - meaning no login is required to trigger it. Public exploit code exists via a GitHub issue (no public exploit identified as actively exploited per CISA KEV), and no vendor-released patch is available at time of analysis.
Open redirect in JeecgBoot's ThirdLoginController (versions 3.9.0-3.9.2) allows remote attackers to manipulate the OAuth `state` parameter and redirect victims to attacker-controlled URLs via the third-party login flow. The vendor's own assessment confirms low real-world exploitability: successful exploitation requires social engineering to induce victims into clicking a crafted OAuth login link, and the affected third-party login feature (DingTalk, WeChat) is optional and likely disabled in most deployments. Publicly available exploit code exists, but no KEV listing indicates active exploitation campaigns at time of analysis.
Information disclosure in JeecgBoot up to 3.9.2 allows authenticated remote attackers to extract password salt values by manipulating the `salt` argument in the `queryPageList` function of the User List Endpoint (`SysUserController.java`). While the CVSS score is low (3.1) due to high attack complexity and a low-privilege authentication requirement, a publicly available proof-of-concept (GitHub issue #9648) exists and no vendor patch has been released - only one planned for a future version. Exposure of salt values is particularly sensitive as it can facilitate offline password hash cracking if hashes are separately obtained.
Improper access control in JeecgBoot's AiragModelController (versions up to 3.9.1) permits any authenticated low-privilege user to invoke the list and queryById API endpoints without proper authorization checks, exposing AI RAG model configuration data restricted to higher-privileged roles. The CVSS vector (PR:L, C:L) confirms this is an authorization bypass rather than a full authentication bypass, limiting impact to confidentiality of AI model metadata. Publicly available exploit code exists (GitHub issue #9599, referenced in the exploit tag), though no CISA KEV listing indicates confirmed widespread active exploitation at time of analysis.
Improper access control in JeecgBoot through version 3.9.1 exposes the LoginController.selectDepart endpoint at /sys/selectDepart, allowing remote attackers to bypass authorization checks tied to department/tenant selection during login. Publicly available exploit code exists per VulDB disclosure, and the vendor has shipped a fix in v3.9.2. No active in-the-wild exploitation has been confirmed (not in CISA KEV), but the public POC and network-reachable attack surface make opportunistic abuse plausible.
Improper access control in JeecgBoot versions up to 3.9.1 allows authenticated low-privileged remote attackers to bypass authorization checks by manipulating the `userIdentity` argument in the SysUser component's `user.getUsername` function at the `/sys/user/login/setting/userEdit` endpoint. A publicly available proof-of-concept exploit exists via GitHub issue #9596, increasing practical risk for any multi-user JeecgBoot deployment where adversaries hold a low-privileged account. Vendor-released patch v3.9.2 is available and explicitly remediates this access control failure alongside several other high-severity issues including RCE and SSRF, indicating a broad security hardening effort in this release cycle.
Improper authentication in JeecgBoot 3.9.1 OpenAPI endpoint allows remote attackers to bypass authentication checks and perform unauthorized actions, though exploitation is rated difficult due to high attack complexity. No public exploit code has been identified and no vendor response has been received. With CVSS 3.7 (Low severity) and AV:N/AC:H/PR:N parameters, the vulnerability poses limited immediate risk but requires monitoring given the authentication bypass nature and remote attack vector.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Server-side request forgery in JeecgBoot up to 3.9.1 allows authenticated remote attackers to manipulate the CommonController.uploadImgByHttp endpoint and trigger arbitrary HTTP requests from the server, with publicly available exploit code and vendor confirmation of the issue. The vulnerability affects the image upload functionality through HttpFileToMultipartFileUtil.httpFileToMultipartFile and downloadImageData methods, enabling attackers with valid credentials to abuse the application as a proxy for outbound requests.
SQL injection in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to execute arbitrary SQL commands through the loadDict endpoint by manipulating the keyword parameter in the SqlInjectionUtil function. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector, and publicly available exploit code exists; patch availability is confirmed via GitHub commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b.
Improper authorization in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to bypass access controls in the SysAnnouncementController component, potentially leading to unauthorized data modification and disclosure. The vulnerability has a CVSS score of 6.3 (medium severity) and carries an EPSS severity rating reflecting real-world exploitability; publicly available exploit code exists and the vendor has confirmed the issue with a patch expected in an upcoming release.
Code injection in JimuReport's Data Source Handler allows authenticated high-privilege users to execute arbitrary code via manipulated dbUrl parameters in the DriverManager.getConnection function (versions up to 2.3.0). The vulnerability requires high-privilege authentication but can be exploited remotely with low attack complexity; publicly available exploit code exists and the vendor has acknowledged the issue with a fix planned for an upcoming release.
Missing authentication in JeecgBoot 3.9.0 and 3.9.1 allows unauthenticated remote attackers to access the AI Chat Module functionality without credential verification. The vulnerability resides in JeecgBizToolsProvider.java within the jeecg-module-system component. Vendor-released patches are available via GitHub commits (b7c9aeba and 2c1cc88b) pending inclusion in the next official release. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and network attack vector (AV:N) with no authentication required (PR:N) indicate trivial exploitation potential.
JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.