Jeewms

jeewms

9 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (9)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-3027 1Jeewms 1Jeewms Jun 17, 2026 Feb 23, 2026 2.1 LOW· v4 6.1 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor re...Show more A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2026-3026 1Jeewms 1Jeewms Jun 17, 2026 Feb 23, 2026 5.5 MEDIUM· v4 7.3 HIGH· v3 7.5 HIGH· v2 A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument...Show more A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2024-53499 1Jeewms 1Jeewms Jun 17, 2026 Aug 22, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.
CVE-2025-50901 1Jeewms 1Jeewms Jun 17, 2026 Aug 20, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
CVE-2025-29213 1Jeewms 1Jeewms Jun 17, 2026 Apr 15, 2025 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.
CVE-2024-57760 1Jeewms 1Jeewms Jun 17, 2026 Jan 15, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.
CVE-2024-57757 1Jeewms 1Jeewms Jun 17, 2026 Jan 15, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.
CVE-2024-27765 1Jeewms 1Jeewms Jun 17, 2026 Mar 5, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component.
CVE-2024-27764 1Jeewms 1Jeewms Jun 17, 2026 Mar 5, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.