汇总 j2eefast 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
常见弱点模式包括 SQL 注入与跨站脚本，在 生产负载与软件部署 使用场景中可能带来 数据泄露与会话劫持 等风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2024-45944 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution. | [email protected] | 9.8 | 0.84% | 2024-10-18 | 2026-06-17 |
| CVE-2024-35091 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. | [email protected] | 9.8 | 0.42% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35090 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. | [email protected] | 8.2 | 0.32% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35086 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . | [email protected] | 9.8 | 0.53% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35085 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. | [email protected] | 5.4 | 0.24% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35084 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. | [email protected] | 9.8 | 0.42% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35083 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. | [email protected] | 8.8 | 0.40% | 2024-05-23 | 2026-06-17 |
| CVE-2024-35082 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. | [email protected] | 6.3 | 0.25% | 2024-05-23 | 2026-06-17 |
| CVE-2024-33164 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. | [email protected] | 9.8 | 0.57% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33161 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. | [email protected] | 5.3 | 0.24% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33155 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. | [email protected] | 9.8 | 0.56% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33153 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. | [email protected] | 9.8 | 0.56% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33149 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. | [email protected] | 8.1 | 0.48% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33148 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. | [email protected] | 7.3 | 0.37% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33147 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. | [email protected] | 8.8 | 0.55% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33146 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. | [email protected] | 9.1 | 0.52% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33144 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. | [email protected] | 8.8 | 0.54% | 2024-05-07 | 2026-06-17 |
| CVE-2024-33139 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. | [email protected] | 7.5 | 0.51% | 2024-05-07 | 2026-06-17 |
| CVE-2023-2476 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The identifier of this vulne | [email protected] | 3.5 | 0.52% | 2023-05-02 | 2026-06-17 |
| CVE-2023-2475 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerabili | [email protected] | 3.5 | 0.52% | 2023-05-02 | 2026-06-17 |