1725 matches found
JeecgBoot v3.7.1 - SQL Injection
The JeecgBoot application is vulnerable to SQL Injection via the getTotalData endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands. id: CVE-2024-48307 info: name: JeecgBoot v3.7.1 - SQL Injection author: lbb,s4e-io...
JeecgBoot JimuReport - Template injection
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...
JeecgBoot 3.5.0 - SQL Injection
jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. id: CVE-2023-34659 info: name: JeecgBoot 3.5.0 - SQL Injection author: ritikchaddha severity: critical description: | jeecg-boot 3.5.0 and 3.5.1 have a SQL injection...
CVE-2026-124555
A SQL injection vulnerability exists in JeecgBoot 3.9.5 within the Table Dictionary API component. The flaw specifically affects the JimuFormApiService.getTableDictList function located in the file /jeecg-boot/jmreport/form/getTableDictList. Improper handling of the searchSql argument allows an a...
EUVD-2026-119777
A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection...
EUVD-2026-119776
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. T...
CVE-2026-124554
A SQL injection vulnerability exists in JeecgBoot 3.9.5 within the JimuBI component. The flaw is located in the /jeecg-boot/drag/onlDragDatasetHead/getAllChartData file, where manipulating the params argument allows for unauthorized database interaction. Remote exploitation is possible, and the e...
CVE-2026-124554 JeecgBoot JimuBI getAllChartData sql injection
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. T...
PT-2026-140212
Name of the Vulnerable Software and Affected Versions JeecgBoot version 3.9.5 Description An unauthenticated SQL injection exists in the JimuBI component. A remote attacker can manipulate the params argument at the '/jeecg-boot/drag/onlDragDatasetHead/getAllChartData' endpoint to expose or alter...
CVE-2026-124555: n/a JeecgBoot: A weakness has been identified in JeecgBoot 3.9.5
A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection...
CVE-2026-124554: n/a JeecgBoot: A security flaw has been discovered in JeecgBoot 3.9.5
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. T...
CVE-2023-1454-EXP
JeecgBoot SQL CVE-2023-1454 Exploit 1. Vulnerability Details jeecg-boot version 3.5.0 has an SQL injection vulnerability, which stems from a security issue in the file jmreport/qurestSql, leading to SQL injection via the parameter apiSelectId. 2. Usage python3 CVE-2023-1454.py optional arguments:...
CVE-2026-112017
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
CVE-2026-112017
The JeecgBoot framework (versions before 3.9.5 ) is vulnerable to an SQL Injection flaw within the SqlInjectionUtil component. The root cause is a newline bypass that allows authenticated attackers to circumvent the keyword blocklist by inserting newline characters into dictionary and online repo...
CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
EUVD-2026-103470
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
CVE-2026-112017
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...
