CVE-2024-57760: Improper Neutralization of Special Elements used in an SQL Command

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java...

CVE-2024-57757: Missing Authorization

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...

CVE-2024-57757

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57760

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java...

JeeWMS security vulnerabilities

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS versions prior to v2025.01.01, which stems from a SQL injection vulnerability found via the ReportId parameter in /core/CGReportDao.java...

CVE-2024-57757

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-57757

JeeWMS, a JAVA-based warehouse management system from China Huayi, contains a permission bypass vulnerability in versions prior to v2025.01.01 . The flaw resides in the /interceptors/AuthInterceptor.cava component, which could allow an attacker to gain unauthorized access to the system. To remedi...

CVE-2024-57761

An arbitrary file upload vulnerability in the parserXML method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file...

JeeWMS security vulnerabilities

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS versions prior to v2025.01.01. An attacker exploiting this vulnerability can bypass privileges via component/authInterceptors/AuthInterceptor.cava...

CVE-2024-57760

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java...

CVE-2024-57761

The JeeWMS warehouse management system (a JAVA-based system from China Huayi) is vulnerable to an arbitrary file upload vulnerability in the parserXML() method. This flaw affects versions prior to v2025.01.01 and allows an attacker to execute arbitrary code by uploading a specially crafted file. ...

PT-2025-3553 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions prior to 2025.01.01 Description: The issue is related to a permission bypass in the component /interceptors/AuthInterceptor.cava. This component is part of the JeeWMS system, and the bypass could potentially allow unauthorized...

CVE-2024-57760

The JeeWMS warehouse management system (a JAVA-based system) versions prior to v2025.01.01 are vulnerable to a SQL injection vulnerability. The flaw is located in the ReportId parameter within the /core/CGReportDao.java component. This vulnerability allows for potential exploitation, and as of th...

CVE-2025-0392 Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injection

A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument storecode leads to sql injection. It is possible to launch t...

CVE-2025-0392

CVE-2025-0392 affects Guangzhou Huayi Intelligent Technology Jeewms. The vulnerability targets the datagridGraph function in /graphReportController.do, where manipulating the store_code parameter results in SQL injection. It is exploitable remotely, and public disclosure is noted. Remediation per...

CVE-2025-0392 Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injection

A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument storecode leads to sql injection. It is possible to launch t...

CVE-2025-0391

A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql...

CVE-2025-0391 Guangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injection

A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql...