CVE-2023-4450mediumobserved exploitationCWE-74

CVE-2023-4450: medium-severity vulnerability in jeecgboot JimuReport

jeecgboot JimuReport Template injection

Published · Updated

Follow this CVE+ Monitor JimuReport

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 6.3epss 12%
from disclosure to weapon170 days
Published on NVDAug 21
1st PoC+170d
VulnCheck+351d
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
jeecgboot · JimuReport
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — jeecgboot JimuReport

In the same product, most dangerous first.

CVE-2023-6307MEDIUMjeecgboot JimuReport image path traversalEPSS 0.8%CVE-2025-10771MEDIUMjeecgboot JimuReport DB2 JDBC testConnection deserializationEPSS 0.6%CVE-2025-8963MEDIUMjeecgboot JimuReport Data Large Screen Template testConnection deserializationEPSS 0.6%CVE-2025-10770MEDIUMjeecgboot JimuReport MySQL JDBC testConnection deserializationEPSS 0.4%CVE-2026-5848MEDIUMjeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionEPSS 0.3%