Vulnerabilities

TI-2026-02616 CVE-2026-3028 · GHSA-pqpv-94jx-68vg

erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting

MEDIUM 57

A vulnerability was determined in erzhongxmu JEEWMS up to 3.7.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00367 Published 2026-02-23 No fix listed CWE-79

TI-2025-43095 CVE-2025-70311 · GHSA-x2gm-g5r6-83jw

JEEWMS 1.0 is vulnerable to SQL Injection.

LOW 34

JEEWMS 1.0 is vulnerable to SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00239 Published 2026-02-03 No fix listed CWE-89

TI-2025-37623 CVE-2025-60269 · GHSA-c3cp-w77v-m53p

JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the…

HIGH 80

JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00328 Published 2025-10-10 No fix listed CWE-89

TI-2025-37622 CVE-2025-60268 · GHSA-7ph9-4h47-rqx5

An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the…

MEDIUM 62

An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00361 Published 2025-10-10 No fix listed CWE-77

TI-2025-35186 CVE-2025-55834 · GHSA-3vpx-qmrw-262r

A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker…

MEDIUM 60

A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00327 Published 2025-09-16 No fix listed CWE-79

TI-2025-04842 CVE-2025-5390 · GHSA-3qg8-96ff-3xhq

JeeWMS File filedeal.do filedeal access control

LOW 24

A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2025-05-31 No fix listed CWE-266

TI-2025-04841 CVE-2025-5389 · GHSA-p9v7-m35p-5q23

JeeWMS File generateController.do dogenerateOne2Many access control

LOW 24

A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-05-31 No fix listed CWE-266

TI-2025-04840 CVE-2025-5388 · GHSA-55xg-g89g-mxwj

JeeWMS generateController.do dogenerate sql injection

LOW 24

A vulnerability classified as critical was found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00379 Published 2025-05-31 No fix listed CWE-74

TI-2025-04839 CVE-2025-5387 · GHSA-7m5m-789w-r328

JeeWMS File generateController.do dogenerate access control

LOW 24

A vulnerability classified as critical has been found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-05-31 No fix listed CWE-266

TI-2025-04838 CVE-2025-5386 · GHSA-573x-h396-vgr7

JeeWMS cgformTransController.do transEditor sql injection

LOW 24

A vulnerability was found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00353 Published 2025-05-31 No fix listed CWE-74

TI-2025-04837 CVE-2025-5385 · GHSA-q765-jvvr-jmgw

JeeWMS cgformTemplateController.do doAdd path traversal

LOW 25

A vulnerability was found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00514 Published 2025-05-31 No fix listed CWE-22

TI-2025-04836 CVE-2025-5384 · GHSA-4wpm-qvg3-wvjj

JeeWMS cgAutoListController.do CgAutoListController sql injection

LOW 24

A vulnerability was found in JeeWMS up to 20250504.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00353 Published 2025-05-31 No fix listed CWE-74

TI-2024-38052 CVE-2024-57761 · GHSA-chjr-27f4-5m2h

An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before…

HIGH 70

An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00488 Published 2025-01-14 No fix listed CWE-434

TI-2025-00311 CVE-2025-0392 · GHSA-gc9p-x2hj-5595

Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injection

MEDIUM 57

A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00682 Published 2025-01-11 No fix listed CWE-74

TI-2025-00310 CVE-2025-0391 · GHSA-v2hq-x3jv-7jf8

Guangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00546 Published 2025-01-11 No fix listed CWE-74

TI-2025-00309 CVE-2025-0390 · GHSA-m75w-4gmq-mj6j

Guangzhou Huayi Intelligent Technology Jeewms wmOmNoticeHController.do path traversal

HIGH 70

A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0084 Published 2025-01-11 No fix listed CWE-23

TI-2024-11454 CVE-2024-12347 · GHSA-jfx8-784f-wmww

Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization

MEDIUM 64

A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00616 Published 2024-12-08 No fix listed CWE-266

TI-2024-11097 CVE-2024-11961 · GHSA-89c4-58v4-9j7x

Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure

LOW 38

A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0087 Published 2024-11-28 No fix listed CWE-200

TI-2024-10423 CVE-2024-11251 · GHSA-cp82-336p-fjw5

erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection

MEDIUM 57

A vulnerability was found in erzhongxmu Jeewms up to 20241108.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00533 Published 2024-11-15 No fix listed CWE-74

Vulnerabilities

Filters