Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

JeecgBoot — Vulnerabilities & Security Advisories 153

All 153 CVE vulnerabilities found in JeecgBoot, with AI-generated Chinese analysis, references, and POCs.

This page documents common weakness vulnerabilities associated with the JeecgBoot open-source development platform developed by Jeecg. It serves as a centralized aggregation resource for tracking security issues within this specific software ecosystem. The content on this page collects vulnerability reports related to framework misconfigurations, input validation errors, and potential remote code execution flaws. The data covers publicly disclosed security incidents from the platform's inception through the current year, ensuring a comprehensive historical view of its security posture. By aggregating data from various public vulnerability databases and vendor announcements, this resource aims to provide clarity on the evolving threat landscape for JeecgBoot users. Visitors can use this page to track a vendor's advisories and understand the specific weakness classes that affect the application. It allows developers and security administrators to look up a product's vulnerability history, helping them assess risk exposure and prioritize patching efforts. Understanding these patterns aids in identifying recurring issues in the codebase or configuration defaults. This structured view supports informed decision-making regarding upgrade paths and security hardening measures. By consolidating disparate reports into a single location, it simplifies the process of maintaining secure deployments of the JeecgBoot platform. Users can monitor new disclosures as they emerge and compare them against past incidents to gauge the severity and impact of each reported flaw.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-108619 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint CWE-862 5.4 Medium 2026-10-10
CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint CWE-862 4.3 Medium 2026-10-10
CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint CWE-862 4.3 Medium 2026-10-10
CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch CWE-862 5.4 Medium 2026-10-10
CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete CWE-862 5.4 Medium 2026-10-10
CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls CWE-862 4.3 Medium 2026-10-10
CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint CWE-862 5.4 Medium 2026-10-10
CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch CWE-862 5.4 Medium 2026-10-10
CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint CWE-862 5.4 Medium 2026-10-10
CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint CWE-862 4.3 Medium 2026-10-10
CVE-2026-108609 JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter CWE-639 4.3 Medium 2026-10-10
CVE-2026-108608 JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter CWE-639 4.3 Medium 2026-10-10
CVE-2026-108607 JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter CWE-639 4.3 Medium 2026-10-10
CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById CWE-862 5.4 Medium 2026-10-10
CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint CWE-862 4.3 Medium 2026-10-10
CVE-2026-86228 JeecgBoot AiragModelController.java exportXls access control CWE-284 4.3 Medium 2026-09-06
CVE-2026-19000 JeecgBoot Anonymous Chat Attachment send server-side request forgery CWE-918 7.3 High 2026-08-06
CVE-2026-58377 JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys CWE-862 8.1 High 2026-06-30
CVE-2026-11502 JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect CWE-601 3.1 Low 2026-06-08
CVE-2026-11464 JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure CWE-200 3.1 Low 2026-06-07
CVE-2026-10240 JeecgBoot test server-side request forgery CWE-918 6.3 Medium 2026-06-01
CVE-2026-10239 JeecgBoot edit WordUtil.addImage server-side request forgery CWE-918 6.3 Medium 2026-06-01
CVE-2026-9604 JeecgBoot AiragModelController access control CWE-284 4.3 Medium 2026-05-26
CVE-2026-9581 JeecgBoot add access control CWE-284 6.3 Medium 2026-05-26
CVE-2026-9580 JeecgBoot selectDepart LoginController.selectDepart access control CWE-284 7.3 High 2026-05-26
CVE-2026-9579 JeecgBoot SysUser userEdit user.getUsername access control CWE-284 6.3 Medium 2026-05-26
CVE-2026-9373 JeecgBoot OpenAPI Endpoint call improper authentication CWE-287 3.7 Low 2026-05-24
CVE-2026-8196 JeecgBoot mLogin Endpoint LoginController.java authorization CWE-639 3.7 Low 2026-05-09
CVE-2026-8195 JeecgBoot SVG File CommonController.java cross site scripting CWE-79 4.3 Medium 2026-05-09
CVE-2026-8114 JeecgBoot JSON Object loadTreeData sql injection CWE-89 6.3 Medium 2026-05-07

All 153 known CVE vulnerabilities affecting JeecgBoot with full Chinese analysis, references, and POCs where available.