| शीर्षक | 广州华壹智能科技有限公司 JeeWMS latest RCE |
|---|
| विवरण | JEEWMS exposes the JimuReport test-connection endpoint at /base-boot/jmreport/testConnection without authentication. The endpoint accepts attacker-controlled JDBC connection parameters and attempts to create a database connection using the supplied driver and URL. In affected environments, this can be abused to trigger arbitrary class instantiation through the PostgreSQL JDBC socketFactory mechanism and may lead to remote code execution. |
|---|
| स्रोत | ⚠️ https://github.com/0d000721999/evc1/issues/1 |
|---|
| उपयोगकर्ता | 0d00 (UID 98238) |
|---|
| सबमिशन | 13/05/2026 05:31 PM (26 दिन पहले) |
|---|
| संयम | 06/06/2026 06:02 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 369076 [erzhongxmu JeeWMS तक 141740afb2ba14d441c82a833d0a418d07ca2d69 JimuReport test-connection Endpoint testConnection dbType/dbDriver/dbUrl/dbUsername/dbPassword अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|