Jeecg vulnerabilities
We track 19 vulnerabilities in Jeecg products across 4 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on April 1, 2026.
Latest Jeecg vulnerabilities
- 9.8 Critical severity
Jeecg Boot: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request.
- 9.8 Critical severity
Jeecg Boot: Improper Control of Generation of Code
There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.
- 8.8 High severity
JeecgBoot: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads
- 7.5 High severity
JeecgBoot: Deserialization of Untrusted Data
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manip
- 8.8 High severity
JeecgBoot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can
- 9.8 Critical severity
Jimureport: Improper Control of Generation of Code
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java
- 7.5 High severity
JeecgBoot: Incorrect Authorization
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack ma
- 8.1 High severity
A weakness has been identified in JeecgBoot up to 3.9.0.
A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Ex
- 8.1 High severity
JeecgBoot: Improper Authentication
A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Mu
- 8.8 High severity
JeecgBoot: Incorrect Privilege Assignment
A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made
- 8.8 High severity
JeecgBoot: Incorrect Privilege Assignment
A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of the component WebSocket Message Handler. The manipulation of the argument userIds leads to improper
- 7.5 High severity
JeecgBoot: Uncontrolled Resource Consumption
A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument Fi
- 9.8 Critical severity
Jeecg: Deserialization of Untrusted Data
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.
- 9.8 Critical severity
Jeecg Boot: Improper Control of Generation of Code
SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.
- 9.8 Critical severity
Jeecg Boot: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.
- 9.8 Critical severity
Jeecg Boot: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.
- 9.8 Critical severity
Jeecg Boot: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
- 7.5 High severity
Jeecgboot: Improper Neutralization of Special Elements used in an SQL Command
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.
- 7.5 High severity
Jeecgboot: Improper Neutralization of Special Elements used in an SQL Command
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.