Is org.jeecgframework.boot:jeecg-boot-parent safe ? org.jeecgframework.boot:jeecg-boot-parent (maven) has 12 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 60th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-m7vh-pgfq-v4rq, the advisory selected below
// 12 advisories GHSA-m7vh-pgfq-v4rq Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show. CRIT GHSA-934g-fvcc-4833 jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. CRIT GHSA-23xf-5535-62v5 jeecg-boot 3.5.0 is vulnerable to SQL injection from functionality of the file SysDictMapper.java of the component Sleep Command Handler. CRIT GHSA-6rfv-h5v8-cj7g A vulnerability was found in jeecg-boot 3.5.0 that affects some unknown processing of the component API Documentation. CRIT GHSA-jf7x-57g8-9hm5 An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code. CRIT GHSA-mcw3-h5xg-r95m JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. HIGH GHSA-pm8v-ppx7-8hr4 Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection. HIGH GHSA-qxpm-5ghc-6gc2 jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component. HIGH GHSA-9v66-9239-cqv2 SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PGSleep, DBMSLock.Sleep… MODE GHSA-cvgc-465m-cw9g JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo in method… MODE GHSA-784x-7w88-w564 JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode in method… MODE GHSA-jf2f-hvxx-4rqx jeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface. MODE Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is org.jeecgframework.boot:jeecg-boot-parent safe to install? CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for org.jeecgframework.boot:jeecg-boot-parent (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.jeecgframework.boot:jeecg-boot-parent have known vulnerabilities? Yes. CyberXYZ records 12 known vulnerabilities for org.jeecgframework.boot:jeecg-boot-parent (maven), the worst rated CRITICAL. These include GHSA-m7vh-pgfq-v4rq, GHSA-934g-fvcc-4833, GHSA-23xf-5535-62v5, GHSA-6rfv-h5v8-cj7g, GHSA-jf7x-57g8-9hm5.
How do I check org.jeecgframework.boot:jeecg-boot-parent before installing? Search org.jeecgframework.boot:jeecg-boot-parent in CyberXYZ Check at https://cyberxyz.io/check?q=org.jeecgframework.boot%3Ajeecg-boot-parent . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:38 UTC. The most recent advisory here was published 2024-10-31. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page