CVE-2025-9796mediumCWE-79CWE-94

CVE-2025-9796: fallo de gravedad media en thinkgem JeeSite

thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear JeeSite

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.4%
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
thinkgem · JeeSite
CVEs relacionadas — thinkgem JeeSite

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-3405LOWthinkgem JeeSite Connection path traversalEPSS 0.7%CVE-2025-5186MEDIUMthinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgeryEPSS 0.5%CVE-2025-7763MEDIUMthinkgem JeeSite Site Controller SiteController.java select redirectEPSS 0.5%CVE-2024-8112MEDIUMthinkgem JeeSite Cookie login cross site scriptingEPSS 0.5%CVE-2025-7785MEDIUMthinkgem JeeSite SsoController.java sso redirectEPSS 0.5%CVE-2025-7863MEDIUMthinkgem JeeSite ServletUtils.java redirectUrlEPSS 0.4%