Threat database

CVE-2026-19000 is a server-side request forgery (SSRF) vulnerability in JeecgBoot versions 3.9.0, 3.9.1, and 3.9.2. It affects an unknown function in the /airag/chat/send file of the Anonymous Chat Attachment Parser component. The vulnerability can be exploited remotely without authentication. A fix is planned but not yet available. The CVSS 4.0 base score is 6.9, indicating medium severity.

A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/airagModel/test. The manipulation of the argument baseUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. A fix is planned for the upcoming release.

A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the argument list/queryById results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 3.9.2 is able to resolve this issue. The affected component should be upgraded.

CVE-2026-9581 is a medium severity vulnerability in JeecgBoot versions up to 3.9.1 involving improper access controls in the /sys/comment/add endpoint. This flaw allows remote attackers to manipulate the affected function, potentially bypassing intended access restrictions. Exploits for this vulnerability are publicly available. Upgrading to JeecgBoot version 3.9.2 resolves the issue.

CVE-2026-9580 is a medium severity vulnerability in JeecgBoot versions up to 3.9.1 involving improper access controls in the LoginController.selectDepart function. This flaw allows remote attackers to bypass access restrictions. The issue is fixed by upgrading to version 3.9.2. No known exploits are currently reported in the wild.

CVE-2026-9579 is a medium severity vulnerability in JeecgBoot versions up to 3.9.1. It involves improper access controls in the user.getUsername function within the SysUser component, specifically in the /sys/user/login/setting/userEdit file. The vulnerability arises from manipulation of the userIdentity argument, allowing remote attackers to potentially bypass access restrictions. An exploit has been publicly disclosed. Upgrading to JeecgBoot version 3.9.2 is recommended to address this issue.

CVE-2026-8114 is a medium severity SQL injection vulnerability affecting JeecgBoot versions up to 3.9.1. The issue exists in the JSON Object Handler component, specifically in the /sys/dict/loadTreeData endpoint, where manipulation of the 'condition' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has indicated that this issue should have been fixed recently, but no explicit patch or advisory link is provided. Exploit code is publicly available, though no known widespread exploitation has been reported.

A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component FillRuleUtil Component. The manipulation of the argument ruleClass results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. You should upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.

A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

CVE-2026-5616 is a medium severity vulnerability in JeecgBoot versions 3.9.0 and 3.9.1 involving missing authentication in an unknown function within the AI Chat Module. This flaw allows remote attackers to bypass authentication controls. The issue has been fixed in a commit identified by hashes b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39 and 2c1cc88b8d983868df8c520a343d6ff4369d9e59, which will be included in the next official release. No known exploits are reported in the wild as of now.

JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.