Aggregates CVE and security vulnerability intelligence across all jeewms-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling, vendor risk sql injection, and vendor risk cross-site scripting and related problems; some flaws may lead to vendor impact file overwrite and vendor impact data exposure.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-3027 | A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 2.1 | 0.29% | 2026-02-23 | 2026-04-29 |
| CVE-2026-3026 | A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.5 | 0.35% | 2026-02-23 | 2026-04-29 |
| CVE-2024-53499 | Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. | [email protected] | 9.8 | 0.48% | 2025-08-22 | 2025-09-09 |
| CVE-2025-50901 | JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. | [email protected] | 9.8 | 0.41% | 2025-08-20 | 2025-09-11 |
| CVE-2025-29213 | A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file. | [email protected] | 5.5 | 0.27% | 2025-04-15 | 2025-04-25 |
| CVE-2024-57760 | JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java. | [email protected] | 6.5 | 0.35% | 2025-01-15 | 2025-04-21 |
| CVE-2024-57757 | JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. | [email protected] | 7.5 | 0.39% | 2025-01-15 | 2025-04-18 |
| CVE-2024-27765 | Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component. | [email protected] | 7.5 | 0.88% | 2024-03-05 | 2025-01-21 |
| CVE-2024-27764 | An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. | [email protected] | 9.8 | 0.97% | 2024-03-05 | 2025-01-21 |