Catherines77

[CVE ID]
CVE-2026-36418
[PRODUCT]
https://github.com/jeecgboot/jimureport
[VERSION]
≤V2.3.4
[PROBLEM TYPE]
Remote Code Execution (RCE)
[DESCRIPTION]
JimuReport versions 2.3.4 and below at `/jmreport/executeSelectApi` API do not effectively restrict user input, directly delegating it to the `execute` method of the aviator expression, which leads to aviator expression injection.

Catherines77

[CVE ID]
CVE-2025-66913
[PRODUCT]
https://github.com/jeecgboot/jimureport
[VERSION]
V2.1.3
[PROBLEM TYPE]
Remote Code Execution (RCE)
[DESCRIPTION]
The `/jmreport/testConnection` interface accepts a user-controlled JDBC URL and passes it directly to the H2database driver. A crafted JDBC URL containing `INIT` or `CREATE ALIAS` directives can cause arbitrary Java code execution.

Catherines77

[CVE ID]
CVE-2025-25426
[PRODUCT]
https://github.com/guchengwuyue/yshopmall
[VERSION]
V1.9
[PROBLEM TYPE]
SQL Injection
[DESCRIPTION]
There is a SQL injection vulnerability in the backend of the yshopmall shopping mall system.

Catherines77

[CVE ID]
CVE-2024-57498
[PRODUCT]
https://github.com/saysky/ForestBlog
[VERSION]
lastest
[PROBLEM TYPE]
Stored XSS
[DESCRIPTION]
Stored XSS exists in the administrator backend /admin/article/editSubmit interface