CVE-2024-40489

critical · 9.8

There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.

9.8

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2026-04-01

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
jeecg	jeecg_boot	>= 3.0, <= 3.5.3

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0
https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-40489