https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3027.htmlhttps://patchthecve.com/cve/CVE-2026-3027.htmlWed, 17 Jun 2026 10:42:54 +0000MEDIUM 4.3: A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit https://patchthecve.com/cve/CVE-2026-3026.htmlhttps://patchthecve.com/cve/CVE-2026-3026.htmlWed, 17 Jun 2026 10:42:54 +0000HIGH 7.3: A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotehttps://patchthecve.com/cve/CVE-2024-53499.htmlhttps://patchthecve.com/cve/CVE-2024-53499.htmlWed, 17 Jun 2026 08:08:56 +0000CRITICAL 9.8: Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.https://patchthecve.com/cve/CVE-2025-50901.htmlhttps://patchthecve.com/cve/CVE-2025-50901.htmlWed, 17 Jun 2026 09:35:25 +0000CRITICAL 9.8: JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.https://patchthecve.com/cve/CVE-2025-29213.htmlhttps://patchthecve.com/cve/CVE-2025-29213.htmlWed, 17 Jun 2026 09:05:12 +0000MEDIUM 5.5: A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.https://patchthecve.com/cve/CVE-2024-57760.htmlhttps://patchthecve.com/cve/CVE-2024-57760.htmlWed, 17 Jun 2026 08:13:59 +0000MEDIUM 6.5: JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.https://patchthecve.com/cve/CVE-2024-57757.htmlhttps://patchthecve.com/cve/CVE-2024-57757.htmlWed, 17 Jun 2026 08:13:59 +0000HIGH 7.5: JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.