CVE-2025-51825

JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.

Published: Aug 22, 2025
Updated: Aug 23, 2025
CVE: CVE-2025-51825
GHSA: GHSA-gj8w-ffq9-6828
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
org.jeecgframework.boot / jeecg-boot-base-core	3.4.3	3.8.1

https://github.com/jeecgboot/JeecgBoot/commit/ddf0f61ae59d217b59884921a98a0bc69b143f41
https://github.com/jeecgboot/JeecgBoot/issues/8335
https://r4gd0ll.github.io/2025/JEECGBOOT_BYPASS_SQLInject.html

Vulnerability Database

CVE-2025-51825