Threats affecting pkg:github/jeecgboot/jimureport

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.1	EPSS 0.3%	CVE-2026-5848jeecgboot JimuReport · Code Injection Medium5.1EPSS 0.3%2026-04-09CVE Database V5CVE-2026-5848 CVE-2026-5848 is a medium severity code injection vulnerability in jeecgboot JimuReport versions up to 2.3.0. It affects the DriverManager.getConnection function in the Data Source Handler component, where manipulation of the dbUrl argument can lead to code injection. The vulnerability can be exploited remotely without user interaction and requires high privileges. The vendor has confirmed the issue and plans to release a fix in an upcoming version, but no patch is currently available. Exploit details have been made public, increasing the risk of exploitation. EPSS 0.3%Vulnerability	CVE Database V5	2026-04-09
Critical	9.8	EPSS 0.5%	CVE-2024-44893JimuReport · Improper Privilege Management Critical9.8EPSS 0.5%2024-09-10CVE Database V5CVE-2024-44893 An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request. EPSS 0.5%Vulnerability CWE-269	CVE Database V5	2024-09-10

Page 1 of 1