Jeecg - vulnerabilities (CVEs)

175 CVEs in 5 products, 101 in the last 30 days, newest from 2026-10-18.

Products

• Jeecg Boot - 158 CVEs
• Jimureport - 9 CVEs
• Jeecg - 6 CVEs
• Jeecgboot - 3 CVEs
• Jeecg-boot - 0 CVEs

Newest CVEs of Jeecg

• CVE-2026-112017 - CVSS 7.1 (high), 2026-10-18: JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by…
• CVE-2026-108891 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated…
• CVE-2026-108888 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to…
• CVE-2026-108886 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated…
• CVE-2026-108887 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to…
• CVE-2026-108885 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated…
• CVE-2026-108884 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user…
• CVE-2026-108883 - CVSS 7.1 (high), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify…
• CVE-2026-108882 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated…
• CVE-2026-108881 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other…
• CVE-2026-108879 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other…
• CVE-2026-108880 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to…
• CVE-2026-108878 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated…
• CVE-2026-108877 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt…
• CVE-2026-108876 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to…
• CVE-2026-108875 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to…
• CVE-2026-108874 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT…
• CVE-2026-108873 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT…
• CVE-2026-108872 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user…
• CVE-2026-108871 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged…
• CVE-2026-108870 - CVSS 5.4 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated…
• CVE-2026-108869 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling…
• CVE-2026-108868 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST…
• CVE-2026-108867 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated…
• CVE-2026-108866 - CVSS 5.3 (medium), 2026-10-11: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the…
• CVE-2026-108680 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST…
• CVE-2026-108679 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated…
• CVE-2026-108678 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read…
• CVE-2026-108677 - CVSS 7.1 (high), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to…
• CVE-2026-108676 - CVSS 5.3 (medium), 2026-10-10: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged…