CVE-2025-14909: jeecg boot — Exploit & Fix

Description

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.

Is your site exposed to CVE-2025-14909?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-1018 CWE-1018

Affected Products

Vendor	Product	Versions
jeecg	jeecg_boot	< 3.9.0

References

Advisories & Patches

https://github.com/jeecgboot/JeecgBoot/commit/b686f9fbd1917edffe5922c6362c817a9361cfbd

Exploits

https://github.com/jeecgboot/JeecgBoot/issues/9195 https://github.com/jeecgboot/JeecgBoot/issues/9195#issue-3719368751 https://vuldb.com/?submit.715743

Other References

https://vuldb.com/?ctiid.337433 https://vuldb.com/?id.337433

Frequently Asked Questions

What is CVE-2025-14909? +

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2025-14909? +

CVE-2025-14909 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-14909? +

CVE-2025-14909 affects products from jeecg, specifically: jeecg_boot. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-14909? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-48307 9.8

JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.

CVE-2023-49442 9.8

Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST …

CVE-2024-44893 9.8

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.

CVE-2025-8963 6.3

A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the …

CVE-2025-10707 6.3

A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing …

CVE-2025-61188 6.3

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with …

CVE-2025-14909