WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jeecg-boot-common✕
Overview 8 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
8matches 0in Waratek scope0.0% 0protected0.0% 1exploited12.5% 0CISA KEV0.0% 2public PoC25.0% 1EPSS ≥ 0.512.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 8 100.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 6 75.0% High 1 12.5% Medium 1 12.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 1 12.5% Proof of concept only 2 25.0% Forecast only 0 0.0% No public exploit 4 50.0%
split by peak 4 / quarter
Outside Waratek scope: 8 Medium: 1High: 1Critical: 6 not blocked: 8 No public exploit: 4Proof of concept only: 2Working exploit published: 1Exploited: 1
Q1 231 Outside Waratek scope1 Critical1 not blocked1 Exploited1 Q2 230 Q3 232 Outside Waratek scope2 Critical2 not blocked2 Working exploit published1 No public exploit1 Q4 234 Outside Waratek scope4 Critical3 Medium1 not blocked4 Proof of concept only1 No public exploit3 Q1 240 Q2 240 Q3 240 Q4 240 Q1 251 Outside Waratek scope1 High1 not blocked1 Proof of concept only1
Q1 23Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-57606 High 2025-02-07 Outside Waratek scope Proof of concept only SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component.
CVE-2023-41544 Critical 2023-12-30 Outside Waratek scope No public exploit SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.
CVE-2023-41543 Critical 2023-12-30 Outside Waratek scope No public exploit SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.
CVE-2023-41542 Critical 2023-12-30 Outside Waratek scope Proof of concept only SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.
CVE-2023-47467 Medium 2023-11-22 Outside Waratek scope No public exploit Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.
CVE-2023-40989 Critical 2023-09-22 Outside Waratek scope No public exploit SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
CVE-2023-38992 Critical 2023-07-28 Outside Waratek scope Working exploit published jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
CVE-2023-1454 Critical 2023-03-17 Outside Waratek scope Exploited A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.