https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3028.htmlhttps://patchthecve.com/cve/CVE-2026-3028.htmlWed, 17 Jun 2026 10:42:54 +0000MEDIUM 4.3: A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. Thehttps://patchthecve.com/cve/CVE-2026-3027.htmlhttps://patchthecve.com/cve/CVE-2026-3027.htmlWed, 17 Jun 2026 10:42:54 +0000MEDIUM 4.3: A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit https://patchthecve.com/cve/CVE-2026-3026.htmlhttps://patchthecve.com/cve/CVE-2026-3026.htmlWed, 17 Jun 2026 10:42:54 +0000HIGH 7.3: A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotehttps://patchthecve.com/cve/CVE-2025-70311.htmlhttps://patchthecve.com/cve/CVE-2025-70311.htmlWed, 17 Jun 2026 10:03:17 +0000MEDIUM 6.5: JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface for attack.https://patchthecve.com/cve/CVE-2025-60268.htmlhttps://patchthecve.com/cve/CVE-2025-60268.htmlWed, 17 Jun 2026 09:49:37 +0000MEDIUM 6.5: An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code execution.https://patchthecve.com/cve/CVE-2025-60269.htmlhttps://patchthecve.com/cve/CVE-2025-60269.htmlWed, 17 Jun 2026 09:49:37 +0000CRITICAL 9.4: JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.https://patchthecve.com/cve/CVE-2025-55834.htmlhttps://patchthecve.com/cve/CVE-2025-55834.htmlWed, 17 Jun 2026 09:42:12 +0000MEDIUM 6.1: A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do componenthttps://patchthecve.com/cve/CVE-2024-53499.htmlhttps://patchthecve.com/cve/CVE-2024-53499.htmlWed, 17 Jun 2026 08:08:56 +0000CRITICAL 9.8: Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.https://patchthecve.com/cve/CVE-2025-50901.htmlhttps://patchthecve.com/cve/CVE-2025-50901.htmlWed, 17 Jun 2026 09:35:25 +0000CRITICAL 9.8: JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.https://patchthecve.com/cve/CVE-2025-5390.htmlhttps://patchthecve.com/cve/CVE-2025-5390.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This https://patchthecve.com/cve/CVE-2025-5389.htmlhttps://patchthecve.com/cve/CVE-2025-5389.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack mahttps://patchthecve.com/cve/CVE-2025-5388.htmlhttps://patchthecve.com/cve/CVE-2025-5388.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes the approach of rollinghttps://patchthecve.com/cve/CVE-2025-5387.htmlhttps://patchthecve.com/cve/CVE-2025-5387.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. This prodhttps://patchthecve.com/cve/CVE-2025-5386.htmlhttps://patchthecve.com/cve/CVE-2025-5386.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransController.do?transEditor. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This https://patchthecve.com/cve/CVE-2025-5385.htmlhttps://patchthecve.com/cve/CVE-2025-5385.htmlWed, 17 Jun 2026 09:47:49 +0000MEDIUM 6.3: A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplateController.do?doAdd. The manipulation leads to path traversal. The attack can be initiated remotely. Continious delivery with rolling releasehttps://patchthecve.com/cve/CVE-2025-5384.htmlhttps://patchthecve.com/cve/CVE-2025-5384.htmlWed, 17 Jun 2026 09:47:48 +0000MEDIUM 6.3: A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListController.do?datagrid. The manipulation leads to sql injection. It is possible to initiate the attack remotely. This product takes the approahttps://patchthecve.com/cve/CVE-2025-29213.htmlhttps://patchthecve.com/cve/CVE-2025-29213.htmlWed, 17 Jun 2026 09:05:12 +0000MEDIUM 5.5: A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.https://patchthecve.com/cve/CVE-2024-57761.htmlhttps://patchthecve.com/cve/CVE-2024-57761.htmlWed, 17 Jun 2026 08:13:59 +0000HIGH 8.1: An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file.https://patchthecve.com/cve/CVE-2024-57760.htmlhttps://patchthecve.com/cve/CVE-2024-57760.htmlWed, 17 Jun 2026 08:13:59 +0000MEDIUM 6.5: JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.https://patchthecve.com/cve/CVE-2024-57757.htmlhttps://patchthecve.com/cve/CVE-2024-57757.htmlWed, 17 Jun 2026 08:13:59 +0000HIGH 7.5: JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.https://patchthecve.com/cve/CVE-2025-0392.htmlhttps://patchthecve.com/cve/CVE-2025-0392.htmlWed, 17 Jun 2026 08:26:23 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch thehttps://patchthecve.com/cve/CVE-2025-0391.htmlhttps://patchthecve.com/cve/CVE-2025-0391.htmlWed, 17 Jun 2026 08:26:22 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql injecthttps://patchthecve.com/cve/CVE-2025-0390.htmlhttps://patchthecve.com/cve/CVE-2025-0390.htmlWed, 17 Jun 2026 08:26:22 +0000MEDIUM 5.3: A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit hhttps://patchthecve.com/cve/CVE-2024-12347.htmlhttps://patchthecve.com/cve/CVE-2024-12347.htmlWed, 17 Jun 2026 06:59:32 +0000MEDIUM 5.3: A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorhttps://patchthecve.com/cve/CVE-2024-11961.htmlhttps://patchthecve.com/cve/CVE-2024-11961.htmlWed, 17 Jun 2026 06:58:46 +0000MEDIUM 5.3: A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. The manipulation of the argument request leads to information dischttps://patchthecve.com/cve/CVE-2024-11251.htmlhttps://patchthecve.com/cve/CVE-2024-11251.htmlWed, 17 Jun 2026 06:57:23 +0000MEDIUM 6.3: A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begin_date leads to sql injection. The attack may be initiatedhttps://patchthecve.com/cve/CVE-2024-27765.htmlhttps://patchthecve.com/cve/CVE-2024-27765.htmlWed, 17 Jun 2026 07:20:15 +0000HIGH 7.5: Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component.https://patchthecve.com/cve/CVE-2024-27764.htmlhttps://patchthecve.com/cve/CVE-2024-27764.htmlWed, 17 Jun 2026 07:20:15 +0000CRITICAL 9.8: An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.