https://feed.craftedsignal.io/products/jeecgboot-3.9.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 03:24:09 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-jeecgboot-sqli/Mon, 09 Nov 2026 03:24:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-jeecgboot-sqli/A security flaw in JeecgBoot 3.9.5 allows for SQL injection via the params argument in the getAllChartData endpoint of the JimuBI component.<p>A security flaw has been discovered in JeecgBoot 3.9.5 affecting the component JimuBI, specifically the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData. Manipulation of the 'params' argument results in SQL injection. Remote exploitation is possible, and public exploit code has been released. The vendor was contacted but did not respond.</p> mediumadvisory