https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66913.htmlhttps://patchthecve.com/cve/CVE-2025-66913.htmlWed, 17 Jun 2026 09:57:19 +0000CRITICAL 9.8: JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVhttps://patchthecve.com/cve/CVE-2025-10771.htmlhttps://patchthecve.com/cve/CVE-2025-10771.htmlWed, 17 Jun 2026 08:28:57 +0000MEDIUM 6.3: A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack canhttps://patchthecve.com/cve/CVE-2025-10770.htmlhttps://patchthecve.com/cve/CVE-2025-10770.htmlWed, 17 Jun 2026 08:28:57 +0000MEDIUM 6.3: A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the component MySQL JDBC Handler. Performing manipulation results in deserialization. Remote exploitation of the attack is possible. The exploit has bhttps://patchthecve.com/cve/CVE-2025-8963.htmlhttps://patchthecve.com/cve/CVE-2025-8963.htmlWed, 17 Jun 2026 10:08:02 +0000MEDIUM 6.3: A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. Thehttps://patchthecve.com/cve/CVE-2024-44893.htmlhttps://patchthecve.com/cve/CVE-2024-44893.htmlWed, 17 Jun 2026 07:53:12 +0000CRITICAL 9.8: An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.