PT-2025-38669

CVE-2025-10771

Published

2025-09-21

Updated

2025-10-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.1.2

Description A vulnerability exists in jeecgboot JimuReport. The issue is related to deserialization triggered by manipulating the clientRerouteServerListJNDIName argument within an unknown function of the /drag/onlDragDataSource/testConnection file of the DB2 JDBC Handler component. This can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 2.1.2 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-502: Deserialization of Untrusted Data

Related identifiers