Jeecg Boot (Jeecg) - vulnerabilities (CVEs)

158 CVEs, 101 in the last 30 days, 44 known versions, newest CVE from 2026-10-18. Vendor: Jeecg.

CVEs of Jeecg Boot

CVE-2026-112017 - CVSS 7.1 (high), 2026-10-18: JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by…
CVE-2026-108891 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated…
CVE-2026-108888 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to…
CVE-2026-108887 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to…
CVE-2026-108886 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated…
CVE-2026-108885 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated…
CVE-2026-108884 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user…
CVE-2026-108883 - CVSS 7.1 (high), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify…
CVE-2026-108882 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated…
CVE-2026-108881 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other…
CVE-2026-108880 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to…
CVE-2026-108879 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other…
CVE-2026-108878 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated…
CVE-2026-108877 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt…
CVE-2026-108876 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to…
CVE-2026-108874 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT…
CVE-2026-108875 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to…
CVE-2026-108873 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT…
CVE-2026-108871 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged…
CVE-2026-108872 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user…
CVE-2026-108870 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated…
CVE-2026-108869 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling…
CVE-2026-108868 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST…
CVE-2026-108867 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated…
CVE-2026-108866 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the…
CVE-2026-108680 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST…
CVE-2026-108679 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated…
CVE-2026-108678 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read…
CVE-2026-108677 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to…
CVE-2026-108676 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged…
CVE-2026-108675 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…
CVE-2026-108674 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated…
CVE-2026-108673 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to…
CVE-2026-108672 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated…
CVE-2026-108671 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the…
CVE-2026-108670 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated…
CVE-2026-108669 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission…
CVE-2026-108668 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated…
CVE-2026-108667 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates…
CVE-2026-108666 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user…
CVE-2026-108665 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify…
CVE-2026-108663 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to…
CVE-2026-108664 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…
CVE-2026-108662 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product…
CVE-2026-108660 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT…
CVE-2026-108661 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…
CVE-2026-108659 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated…
CVE-2026-108658 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated…
CVE-2026-108657 - CVSS 8.6 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to…
CVE-2026-108656 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows…
CVE-2026-108655 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated…
CVE-2026-108654 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated…
CVE-2026-108653 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to…
CVE-2026-108652 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to…
CVE-2026-108650 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any…
CVE-2026-108651 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users…
CVE-2026-108649 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users…
CVE-2026-108648 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which…
CVE-2026-108647 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the…
CVE-2026-108646 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to…
CVE-2026-108645 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary…
CVE-2026-108644 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to…
CVE-2026-108643 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries…
CVE-2026-108642 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users'…
CVE-2026-108641 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application…
CVE-2026-108640 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission…
CVE-2026-108639 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the…
CVE-2026-108638 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the…
CVE-2026-108637 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling…
CVE-2026-108636 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to…
CVE-2026-108635 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows…
CVE-2026-108634 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings…
CVE-2026-108633 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings…
CVE-2026-108632 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated…
CVE-2026-108631 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged…
CVE-2026-108630 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify…
CVE-2026-108629 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any…
CVE-2026-108628 - CVSS 8.6 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any…
CVE-2026-108627 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query…
CVE-2026-108626 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated…
CVE-2026-108625 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by…
CVE-2026-108624 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged…
CVE-2026-108623 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to…
CVE-2026-108622 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete…
CVE-2026-108621 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify…
CVE-2026-108620 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to…
CVE-2026-108618 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT…
CVE-2026-108619 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the…
CVE-2026-108617 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling…
CVE-2026-108615 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated…
CVE-2026-108616 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to…
CVE-2026-108614 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to…
CVE-2026-108612 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged…
CVE-2026-108613 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish…
CVE-2026-108611 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to…
CVE-2026-108609 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation…
CVE-2026-108610 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to…
CVE-2026-108608 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by…
CVE-2026-108606 - CVSS 5.4 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete…
CVE-2026-108607 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation…