Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

JeecgBoot — Vulnerabilities & Security Advisories 153

All 153 CVE vulnerabilities found in JeecgBoot, with AI-generated Chinese analysis, references, and POCs.

This page documents common weakness vulnerabilities associated with the JeecgBoot open-source development platform developed by Jeecg. It serves as a centralized aggregation resource for tracking security issues within this specific software ecosystem. The content on this page collects vulnerability reports related to framework misconfigurations, input validation errors, and potential remote code execution flaws. The data covers publicly disclosed security incidents from the platform's inception through the current year, ensuring a comprehensive historical view of its security posture. By aggregating data from various public vulnerability databases and vendor announcements, this resource aims to provide clarity on the evolving threat landscape for JeecgBoot users. Visitors can use this page to track a vendor's advisories and understand the specific weakness classes that affect the application. It allows developers and security administrators to look up a product's vulnerability history, helping them assess risk exposure and prioritize patching efforts. Understanding these patterns aids in identifying recurring issues in the codebase or configuration defaults. This structured view supports informed decision-making regarding upgrade paths and security hardening measures. By consolidating disparate reports into a single location, it simplifies the process of maintaining secure deployments of the JeecgBoot platform. Users can monitor new disclosures as they emerge and compare them against past incidents to gauge the severity and impact of each reported flaw.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-126998 JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery CWE-918 7.3 High 2026-11-12
CVE-2026-126997 JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery CWE-918 7.3 High 2026-11-12
CVE-2026-124555 JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection CWE-89 6.3 Medium 2026-11-09
CVE-2026-124554 JeecgBoot JimuBI getAllChartData sql injection CWE-89 7.3 High 2026-11-09
CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass CWE-89 6.5 Medium 2026-10-18
CVE-2026-108891 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId CWE-862 4.3 Medium 2026-10-11
CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls CWE-862 4.3 Medium 2026-10-11
CVE-2026-108887 JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls CWE-862 4.3 Medium 2026-10-11
CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername CWE-862 4.3 Medium 2026-10-11
CVE-2026-108884 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint CWE-862 5.4 Medium 2026-10-11
CVE-2026-108885 JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete CWE-862 5.4 Medium 2026-10-11
CVE-2026-108883 JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig CWE-862 6.5 Medium 2026-10-11
CVE-2026-108882 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser CWE-862 5.4 Medium 2026-10-11
CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo CWE-862 4.3 Medium 2026-10-11
CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId CWE-862 4.3 Medium 2026-10-11
CVE-2026-108879 JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter CWE-639 4.3 Medium 2026-10-11
CVE-2026-108877 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete CWE-862 5.4 Medium 2026-10-11
CVE-2026-108878 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById CWE-862 4.3 Medium 2026-10-11
CVE-2026-108876 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit CWE-862 4.3 Medium 2026-10-11
CVE-2026-108875 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup CWE-862 4.3 Medium 2026-10-11
CVE-2026-108874 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson CWE-862 4.3 Medium 2026-10-11
CVE-2026-108873 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo CWE-862 4.3 Medium 2026-10-11
CVE-2026-108872 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers CWE-862 4.3 Medium 2026-10-11
CVE-2026-108870 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule CWE-862 5.4 Medium 2026-10-11
CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule CWE-862 5.4 Medium 2026-10-11
CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement CWE-862 4.3 Medium 2026-10-11
CVE-2026-108867 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById CWE-862 4.3 Medium 2026-10-11
CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement CWE-862 4.3 Medium 2026-10-11
CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths CWE-862 4.3 Medium 2026-10-11
CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement CWE-862 4.3 Medium 2026-10-10

All 153 known CVE vulnerabilities affecting JeecgBoot with full Chinese analysis, references, and POCs where available.