CVE-2026-108880

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

EUVD-2026-97054

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the PUT /sys/dict/editDictByLowAppId endpoint. This vulnerability allows any authenticated user to modify low-code application dictionaries by providing a low_app_id (which can be discovered via GET /sys/dict/list)...

CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108880: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-8114: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the component JSON Object Handler. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The explo...

CVE-2023-38992: Improper Neutralization of Special Elements used in an SQL Command

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...

CVE-2023-38992

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...

CVE-2022-47105

Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

Jeecg-boot SQL注入漏洞

Jeecg-Boot is a code generator-based low-code platform from the JeecgBoot community. A security vulnerability exists in Jeecg-boot v3.4.4, which stems from Jeecg-boot v3.4.4 was found to contain a SQL injection vulnerability via component /sys/dict/queryTableData...

CVE-2022-47105

Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

CVE-2022-47105

Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

CVE-2022-45205

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

CVE-2022-45205

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

CVE-2022-45205

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

CVE-2022-45205: Improper Neutralization of Special Elements used in an SQL Command

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData...

PT-2021-11443

Name of the Vulnerable Software and Affected Versions: jeecg-boot CMS version 2.3 Description: A SQL injection issue in the "/jeecg boot/sys/dict/loadtreedata" endpoint of jeecg-boot CMS allows attackers to access sensitive database information. Recommendations: For jeecg-boot CMS version 2.3,...

CVE-2020-28087: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information...