# cve.now: Jeecgboot

The newest entries naming Jeecgboot as an affected vendor (up to 200), of 113 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112017](https://cve.now/CVE-2026-112017.md): JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass (CVSS 7.1)
- [CVE-2026-108891](https://cve.now/CVE-2026-108891.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId (CVSS 5.3)
- [CVE-2026-108888](https://cve.now/CVE-2026-108888.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls (CVSS 5.3)
- [CVE-2026-108887](https://cve.now/CVE-2026-108887.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls (CVSS 5.3)
- [CVE-2026-108886](https://cve.now/CVE-2026-108886.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername (CVSS 5.3)
- [CVE-2026-108885](https://cve.now/CVE-2026-108885.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete (CVSS 5.3)
- [CVE-2026-108884](https://cve.now/CVE-2026-108884.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint (CVSS 5.3)
- [CVE-2026-108883](https://cve.now/CVE-2026-108883.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig (CVSS 7.1)
- [CVE-2026-108882](https://cve.now/CVE-2026-108882.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser (CVSS 5.3)
- [CVE-2026-108881](https://cve.now/CVE-2026-108881.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo (CVSS 5.3)
- [CVE-2026-108880](https://cve.now/CVE-2026-108880.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId (CVSS 5.3)
- [CVE-2026-108879](https://cve.now/CVE-2026-108879.md): JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter (CVSS 5.3)
- [CVE-2026-108878](https://cve.now/CVE-2026-108878.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById (CVSS 5.3)
- [CVE-2026-108877](https://cve.now/CVE-2026-108877.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete (CVSS 5.3)
- [CVE-2026-108876](https://cve.now/CVE-2026-108876.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit (CVSS 5.3)
- [CVE-2026-108875](https://cve.now/CVE-2026-108875.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup (CVSS 5.3)
- [CVE-2026-108874](https://cve.now/CVE-2026-108874.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson (CVSS 5.3)
- [CVE-2026-108873](https://cve.now/CVE-2026-108873.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo (CVSS 5.3)
- [CVE-2026-108872](https://cve.now/CVE-2026-108872.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers (CVSS 5.3)
- [CVE-2026-108871](https://cve.now/CVE-2026-108871.md): JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule (CVSS 5.3)
- [CVE-2026-108870](https://cve.now/CVE-2026-108870.md): JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule (CVSS 5.3)
- [CVE-2026-108869](https://cve.now/CVE-2026-108869.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement (CVSS 5.3)
- [CVE-2026-108868](https://cve.now/CVE-2026-108868.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement (CVSS 5.3)
- [CVE-2026-108867](https://cve.now/CVE-2026-108867.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById (CVSS 5.3)
- [CVE-2026-108866](https://cve.now/CVE-2026-108866.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths (CVSS 5.3)
- [CVE-2026-108680](https://cve.now/CVE-2026-108680.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement (CVSS 5.3)
- [CVE-2026-108679](https://cve.now/CVE-2026-108679.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement (CVSS 5.3)
- [CVE-2026-108678](https://cve.now/CVE-2026-108678.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles (CVSS 5.3)
- [CVE-2026-108677](https://cve.now/CVE-2026-108677.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName (CVSS 7.1)
- [CVE-2026-108676](https://cve.now/CVE-2026-108676.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles (CVSS 5.3)
- [CVE-2026-108675](https://cve.now/CVE-2026-108675.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop (CVSS 5.3)
- [CVE-2026-108674](https://cve.now/CVE-2026-108674.md): JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById (CVSS 5.3)
- [CVE-2026-108673](https://cve.now/CVE-2026-108673.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls (CVSS 5.3)
- [CVE-2026-108672](https://cve.now/CVE-2026-108672.md): JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser (CVSS 5.3)
- [CVE-2026-108671](https://cve.now/CVE-2026-108671.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById (CVSS 7.1)
- [CVE-2026-108670](https://cve.now/CVE-2026-108670.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment (CVSS 5.3)
- [CVE-2026-108669](https://cve.now/CVE-2026-108669.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search (CVSS 5.3)
- [CVE-2026-108668](https://cve.now/CVE-2026-108668.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin (CVSS 5.3)
- [CVE-2026-108667](https://cve.now/CVE-2026-108667.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin (CVSS 5.3)
- [CVE-2026-108666](https://cve.now/CVE-2026-108666.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch (CVSS 5.3)
- [CVE-2026-108665](https://cve.now/CVE-2026-108665.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit (CVSS 5.3)
- [CVE-2026-108664](https://cve.now/CVE-2026-108664.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById (CVSS 5.3)
- [CVE-2026-108663](https://cve.now/CVE-2026-108663.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply (CVSS 5.3)
- [CVE-2026-108662](https://cve.now/CVE-2026-108662.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser (CVSS 5.3)
- [CVE-2026-108661](https://cve.now/CVE-2026-108661.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant (CVSS 7.1)
- [CVE-2026-108660](https://cve.now/CVE-2026-108660.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus (CVSS 5.3)
- [CVE-2026-108659](https://cve.now/CVE-2026-108659.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId (CVSS 5.3)
- [CVE-2026-108658](https://cve.now/CVE-2026-108658.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo (CVSS 5.3)
- [CVE-2026-108657](https://cve.now/CVE-2026-108657.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply (CVSS 8.6)
- [CVE-2026-108656](https://cve.now/CVE-2026-108656.md): JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint (CVSS 5.3)
- [CVE-2026-108655](https://cve.now/CVE-2026-108655.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById (CVSS 5.3)
- [CVE-2026-108654](https://cve.now/CVE-2026-108654.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById (CVSS 5.3)
- [CVE-2026-108653](https://cve.now/CVE-2026-108653.md): JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list (CVSS 5.3)
- [CVE-2026-108652](https://cve.now/CVE-2026-108652.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar (CVSS 5.3)
- [CVE-2026-108651](https://cve.now/CVE-2026-108651.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId (CVSS 5.3)
- [CVE-2026-108650](https://cve.now/CVE-2026-108650.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet (CVSS 5.3)
- [CVE-2026-108649](https://cve.now/CVE-2026-108649.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById (CVSS 5.3)
- [CVE-2026-108648](https://cve.now/CVE-2026-108648.md): JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint (CVSS 7.1)
- [CVE-2026-108647](https://cve.now/CVE-2026-108647.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel (CVSS 5.3)
- [CVE-2026-108646](https://cve.now/CVE-2026-108646.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel (CVSS 5.3)
- [CVE-2026-108645](https://cve.now/CVE-2026-108645.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit (CVSS 5.3)
- [CVE-2026-108644](https://cve.now/CVE-2026-108644.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete (CVSS 5.3)
- [CVE-2026-108643](https://cve.now/CVE-2026-108643.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch (CVSS 5.3)
- [CVE-2026-108642](https://cve.now/CVE-2026-108642.md): JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit (CVSS 5.3)
- [CVE-2026-108641](https://cve.now/CVE-2026-108641.md): JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne (CVSS 5.3)
- [CVE-2026-108640](https://cve.now/CVE-2026-108640.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById (CVSS 5.3)
- [CVE-2026-108639](https://cve.now/CVE-2026-108639.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id} (CVSS 5.3)
- [CVE-2026-108638](https://cve.now/CVE-2026-108638.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser (CVSS 5.3)
- [CVE-2026-108637](https://cve.now/CVE-2026-108637.md): JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint (CVSS 5.3)
- [CVE-2026-108636](https://cve.now/CVE-2026-108636.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel (CVSS 5.3)
- [CVE-2026-108635](https://cve.now/CVE-2026-108635.md): JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint (CVSS 5.3)
- [CVE-2026-108634](https://cve.now/CVE-2026-108634.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint (CVSS 5.3)
- [CVE-2026-108633](https://cve.now/CVE-2026-108633.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add (CVSS 5.3)
- [CVE-2026-108632](https://cve.now/CVE-2026-108632.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint (CVSS 5.3)
- [CVE-2026-108631](https://cve.now/CVE-2026-108631.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete (CVSS 5.3)
- [CVE-2026-108630](https://cve.now/CVE-2026-108630.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit (CVSS 5.3)
- [CVE-2026-108629](https://cve.now/CVE-2026-108629.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint (CVSS 5.3)
- [CVE-2026-108628](https://cve.now/CVE-2026-108628.md): JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint (CVSS 8.6)
- [CVE-2026-108627](https://cve.now/CVE-2026-108627.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint (CVSS 5.3)
- [CVE-2026-108626](https://cve.now/CVE-2026-108626.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint (CVSS 5.3)
- [CVE-2026-108625](https://cve.now/CVE-2026-108625.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint (CVSS 5.3)
- [CVE-2026-108624](https://cve.now/CVE-2026-108624.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint (CVSS 5.3)
- [CVE-2026-108623](https://cve.now/CVE-2026-108623.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch (CVSS 7.1)
- [CVE-2026-108622](https://cve.now/CVE-2026-108622.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint (CVSS 5.3)
- [CVE-2026-108621](https://cve.now/CVE-2026-108621.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit (CVSS 5.3)
- [CVE-2026-108620](https://cve.now/CVE-2026-108620.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch (CVSS 5.3)
- [CVE-2026-108619](https://cve.now/CVE-2026-108619.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint (CVSS 5.3)
- [CVE-2026-108618](https://cve.now/CVE-2026-108618.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint (CVSS 5.3)
- [CVE-2026-108617](https://cve.now/CVE-2026-108617.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint (CVSS 5.3)
- [CVE-2026-108616](https://cve.now/CVE-2026-108616.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch (CVSS 5.3)
- [CVE-2026-108615](https://cve.now/CVE-2026-108615.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete (CVSS 5.3)
- [CVE-2026-108614](https://cve.now/CVE-2026-108614.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls (CVSS 5.3)
- [CVE-2026-108613](https://cve.now/CVE-2026-108613.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint (CVSS 5.3)
- [CVE-2026-108612](https://cve.now/CVE-2026-108612.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch (CVSS 5.3)
- [CVE-2026-108611](https://cve.now/CVE-2026-108611.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint (CVSS 5.3)
- [CVE-2026-108610](https://cve.now/CVE-2026-108610.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint (CVSS 5.3)
- [CVE-2026-108609](https://cve.now/CVE-2026-108609.md): JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter (CVSS 5.3)
- [CVE-2026-108608](https://cve.now/CVE-2026-108608.md): JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter (CVSS 5.3)
- [CVE-2026-108607](https://cve.now/CVE-2026-108607.md): JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter (CVSS 5.3)
- [CVE-2026-108606](https://cve.now/CVE-2026-108606.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById (CVSS 5.3)
- [CVE-2026-108605](https://cve.now/CVE-2026-108605.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint (CVSS 5.3)
- [CVE-2026-82629](https://cve.now/CVE-2026-82629.md): jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload (CVSS 5.1)
- [CVE-2026-75479](https://cve.now/CVE-2026-75479.md): JimuReport Unauthenticated Report Listing and Share Token Disclosure (CVSS 8.7)
- [CVE-2026-58377](https://cve.now/CVE-2026-58377.md): JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys (CVSS 8.1)
- [CVE-2026-58375](https://cve.now/CVE-2026-58375.md): JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export (CVSS 7.5)
- [CVE-2026-10241](https://cve.now/CVE-2026-10241.md): jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery (CVSS 5.3)
- [CVE-2026-5848](https://cve.now/CVE-2026-5848.md): jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection (CVSS 5.1)
- [CVE-2025-12626](https://cve.now/CVE-2025-12626.md): jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal (CVSS 5.3)
- [CVE-2025-10771](https://cve.now/CVE-2025-10771.md): jeecgboot JimuReport DB2 JDBC testConnection deserialization (CVSS 5.3)
- [CVE-2025-10770](https://cve.now/CVE-2025-10770.md): jeecgboot JimuReport MySQL JDBC testConnection deserialization (CVSS 5.3)
- [CVE-2025-8963](https://cve.now/CVE-2025-8963.md): jeecgboot JimuReport Data Large Screen Template testConnection deserialization (CVSS 5.3)
- [CVE-2023-6307](https://cve.now/CVE-2023-6307.md): jeecgboot JimuReport image path traversal (CVSS 6.3)
- [CVE-2023-4450](https://cve.now/CVE-2023-4450.md): jeecgboot JimuReport Template injection (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jeecgboot
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.