Last active
January 8, 2026 03:00
-
-
Save Catherines77/f15d53e9705b24cf018e5bffed3e8234 to your computer and use it in GitHub Desktop.
CVE-2025-66913
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [CVE ID] | |
| CVE-2025-66913 | |
| [PRODUCT] | |
| https://github.com/jeecgboot/jimureport | |
| [VERSION] | |
| V2.1.3 | |
| [PROBLEM TYPE] | |
| Remote Code Execution (RCE) | |
| [DESCRIPTION] | |
| The `/jmreport/testConnection` interface accepts a user-controlled JDBC URL and passes it directly to the H2database driver. A crafted JDBC URL containing `INIT` or `CREATE ALIAS` directives can cause arbitrary Java code execution. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment