72 matches found
CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln
CVE-2023-1454 Jeecg-Boot-qurestSql-SQLvuln jmreport/qurestSql Unauthorized SQL Injection Batch Scan PoC. Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest version jeecg-boot 3.5.0 has been exposed with multiple SQL injection vulnerabilities. Usage...
CVE-2023-1454
CVE-2023-1454 jmreport/qurestSql Unauthorized SQL Injection Batch Scan POC Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest jeecg-boot 3.5.0 has been exposed to multiple SQL injection vulnerabilities. Description Original tool URL The original tool h...
CVE-2023-1454-EXP
JeecgBoot SQL CVE-2023-1454 Exploit 1. Vulnerability Details jeecg-boot version 3.5.0 has an SQL injection vulnerability, which stems from a security issue in the file jmreport/qurestSql, leading to SQL injection via the parameter apiSelectId. 2. Usage python3 CVE-2023-1454.py optional arguments:...
JeecgBoot 3.5.0 - SQL Injection Detection
jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. !/usr/bin/env python3 -- coding: utf-8 -- """jeecg-boot 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...
Jeecg-boot 3.5.0 qurestSql - SQL Injection Detection
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. !/usr/bin/env python3 -- coding: utf-8 -- ""...
CVE-2026-58375
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...
CVE-2026-58375: Missing Authentication for Critical Function
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...
CVE-2026-36418: Undefined Security Weakness
JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute...
CVE-2024-43028
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
EUVD-2024-55520
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
CVE-2024-43028: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
CVE-2024-43028
The JeecgBoot Java low-code platform, developed by Jeecg Corporation, contains a command injection vulnerability in the /jmreport/show component. This flaw affects versions v3.0.0 to v3.5.3 and allows an attacker to execute arbitrary code by sending a crafted HTTP request . While exploitation det...
CVE-2024-43028
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
JeecgBoot security vulnerability
JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. Versions of JeecgBoot from v3.0.0 to v3.5.3 have security vulnerabilities. These vulnerabilities stem from command injection in the component jmreport/show, which could allow attackers ...
CVE-2024-43028
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
PT-2026-29548
A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...
CVE-2023-1454
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...
PT-2024-31294
Name of the Vulnerable Software and Affected Versions JimuReport version 1.7.8 Description The issue allows an attacker to escalate privileges via a crafted GET request to the /jeecg-boot/jmreport/dict/list component. Recommendations For JimuReport version 1.7.8, consider restricting access to th...
SQL Injection
jeecg-boot is vulnerable to SQL Injection. The vulnerability is caused due to improper input validation in the jmreport/qurestSql component. This could allow an attacker to inject malicious input leading to SQL Injection...
