GCVE - cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Erzhongxmu (`ca737d45-b47b-59c8-834b-1b64b4836c45`)
Product	Jeewms (`643b3e4e-28f3-51ad-af49-970624c3d1fd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-48015`	vulnerable	2026-11-03 10:23:11.873439	JeeWMS Path Traversal via showOrDownByurl.do HIGH (7.5) JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17. Published: 2026-10-22T10:57:30.531Z Updated: 2026-11-05T15:59:12.806Z Open on db.gcve.eu Reference links https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/JEEWMS_%E4%BB%93%E5%BA%93%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%E5%92%8C%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.md https://github.com/tzwlhack/Vulnerability/blob/main/JEEWMS%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md https://github.com/erzhongxmu/JeeWMS/commit/0a610e8178a0a1197e9c6615b58faf67c406d2bc https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/jeewms-lfi.yaml https://www.vulncheck.com/advisories/jeewms-path-traversal-via-showordownbyurl-do	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27765`	vulnerable	2026-06-08 06:31:29.156285	Details available Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component. Published: 2024-03-05T00:00:00.000Z Updated: 2024-08-08T15:13:09.855Z Open on db.gcve.eu Reference links https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27764`	vulnerable	2026-06-08 06:31:29.154718	Details available An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. Published: 2024-03-05T00:00:00.000Z Updated: 2024-08-29T16:55:35.581Z Open on db.gcve.eu Reference links https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-11251`	vulnerable	2026-06-08 06:23:49.197955	erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection MEDIUM (6.3) A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begin_date leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Other parameters might be affected as well. Published: 2024-11-15T18:00:12.868Z Updated: 2024-11-19T16:11:57.733Z Open on db.gcve.eu Reference links https://vuldb.com/?id.284687 https://vuldb.com/?ctiid.284687 https://gitee.com/erzhongxmu/JEEWMS/issues/IB2XZG	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Jeewms

Notes

PURL mappings

Vulnerability references

Contribute