63 matches found
PT-2026-109940
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the sendBusAnnouncement handler of the SystemApiController. This issue allows any authenticated user to send announcements without possessing the necessary...
CVE-2026-108652: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...
CVE-2026-108651: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...
CVE-2026-108678: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...
CVE-2026-108650: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...
CVE-2026-108648: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...
PT-2026-109910
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read the role codes of any user due to missing authorization in the queryUserRolesById handler of the SystemApiController. Low-privileged attackers can exploit this by sendi...
CVE-2026-78970
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
CVE-2026-78970
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
PT-2026-85701
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
CVE-2026-78970
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
CVE-2026-78970
JeecgBoot version 3.9.2 and earlier is vulnerable to an authorization bypass in the SystemApiController component. The root cause is missing fine-grained permission checks and incomplete data desensitization , which allows an authenticated attacker using any valid JWT token to access multiple API...
CVE-2026-78970: Missing Authorization
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
EUVD-2026-71613
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
EUVD-2023-1725
Malicious code in bioql PyPI...
GHSA-784X-7W88-W564 JeecgBoot vulnerable to SQL injection in queryTableDictItemsByCode
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode in method org.jeecg.modules.api.controller.SystemApiController...
JeecgBoot vulnerable to SQL injection in queryTableDictItemsByCode
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode in method org.jeecg.modules.api.controller.SystemApiController...
CVE-2023-34602
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController...