Vulnerabilities

TI-2026-02615 CVE-2026-3027 · GHSA-qg32-r7gw-fcxw

erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting

MEDIUM 57

A vulnerability was found in erzhongxmu JEEWMS up to 3.7.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00344 Published 2026-02-23 No fix listed CWE-79

TI-2026-02614 CVE-2026-3026 · GHSA-6235-7hp8-952p

erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgery

HIGH 70

A vulnerability has been found in erzhongxmu JEEWMS 3.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2026-02-23 No fix listed CWE-918

TI-2024-35822 CVE-2024-53499 · GHSA-m58w-p5vh-32mq

Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.

HIGH 82

Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00531 Published 2025-08-22 No fix listed CWE-89

TI-2025-32266 CVE-2025-50901 · GHSA-v4c8-f47v-cj2h

JeeWMS 771e4f5 (2025-05-19) contains incorrect…

HIGH 82

JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00441 Published 2025-08-20 No fix listed CWE-287

TI-2025-21013 CVE-2025-29213 · GHSA-297c-p9xm-3rhf

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS…

HIGH 66

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00357 Published 2025-04-15 No fix listed CWE-22

TI-2024-38051 CVE-2024-57760 · GHSA-xcq7-98vr-f74j

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the…

LOW 37

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2025-01-14 No fix listed CWE-89

TI-2024-38050 CVE-2024-57757 · GHSA-q2p7-6x52-xxj5

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component…

LOW 35

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2025-01-14 No fix listed CWE-862

TI-2024-18384 CVE-2024-27765 · GHSA-px8r-9qv3-6525

Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to…

HIGH 66

Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00879 Published 2024-03-05 No fix listed CWE-22

TI-2024-18383 CVE-2024-27764 · GHSA-5hwf-f9mj-rjfq

An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.

HIGH 82

An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00969 Published 2024-03-05 No fix listed CWE-27

Vulnerabilities

Filters