6.9
Medium
CVE-2026-124554 JeecgBoot JimuBI getAllChartData sql injection
Description
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JeecgBoot | 3.9.5 | No fix stated |
Other CVEs of JeecgBoot
The 49 CVEs of JeecgBoot →
CVE-2026-124555
JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection
5.3
Medium
CVE-2026-86228
A security vulnerability has been detected in JeecgBoot up to 3.9.3
5.3
Medium
CVE-2026-19000
A vulnerability was identified in JeecgBoot up to 3.9.2
6.9
Medium
CVE-2026-11502
A weakness has been identified in JeecgBoot up to 3.9.2
2.3
Low