PT-2025-38668 · Unknown · Jeecgboot Jimureport

Ez-Lbz · CVE-2025-10770 · Published 2025-09-21 · Updated 2026-01-09

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.1.2

Description A vulnerability exists in jeecgboot JimuReport up to version 2.1.2. The issue impacts an unknown function within the /drag/onlDragDataSource/testConnection file of the MySQL JDBC Handler component, leading to deserialization. Remote exploitation is possible. The exploit has been made public.

Recommendations Versions prior to 2.1.2 should be used. Consider restricting access to the /drag/onlDragDataSource/testConnection file as a temporary workaround.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-10770

Affected Products

Jeecgboot Jimureport

References · 12

• 🔥 https://github.com/jeecgboot/jimureport/issues/4116#issue-3391107887 · Exploit
• 🔥 https://github.com/jeecgboot/jimureport/issues/4116 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10770.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10770 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10770 · Vendor Advisory
• https://vuldb.com/?id.325126 · Note
• https://t.me/cveNotify/137872 · Telegram Post
• https://twitter.com/CVEnew/status/1969897082136809734 · Twitter Post
• https://t.me/CVEtracker/41764 · Telegram Post
• https://t.me/CVEtracker/33017 · Telegram Post
• https://vuldb.com/?submit.649755 · Note
• https://vuldb.com/?ctiid.325126 · Note