PT-2025-38668 · Unknown · Jeecgboot Jimureport

Ez-Lbz · Published 2025-09-21 · Updated 2026-01-09 · CVE-2025-10770

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.1.2

Description A vulnerability exists in jeecgboot JimuReport up to version 2.1.2. The issue impacts an unknown function within the /drag/onlDragDataSource/testConnection file of the MySQL JDBC Handler component, leading to deserialization. Remote exploitation is possible. The exploit has been made public.

Recommendations Versions prior to 2.1.2 should be used. Consider restricting access to the /drag/onlDragDataSource/testConnection file as a temporary workaround.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-10770

Affected Products

Jeecgboot Jimureport

References · 11

• 🔥 https://github.com/jeecgboot/jimureport/issues/4116 · Exploit
• 🔥 https://github.com/jeecgboot/jimureport/issues/4116#issue-3391107887 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10770 · Security Note
• https://t.me/cveNotify/137872 · Telegram Post
• https://vuldb.com/?id.325126 · Note
• https://twitter.com/CVEnew/status/1969897082136809734 · Twitter Post
• https://t.me/CVEtracker/33017 · Telegram Post
• https://vuldb.com/?submit.649755 · Note
• https://vuldb.com/?ctiid.325126 · Note
• https://t.me/CVEtracker/41764 · Telegram Post