CVE-2025-10771
Last modified
CVE-2025-10771 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jeecg | Jimureport | <= 2.1.2 |
References
- https://github.com/jeecgboot/jimureport/issues/4117Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jeecgboot/jimureport/issues/4117#issue-3391268438Exploit, Issue Tracking, Third Party Advisory
- https://vuldb.com/?ctiid.325127Permissions Required, VDB Entry
- https://vuldb.com/?id.325127Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.649778Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-10771?
How severe is CVE-2025-10771?
How do I fix CVE-2025-10771?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10766A weakness has been identified in SeriaWei ZKEACMS up to 4.3…4.3
- CVE-2025-10767A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.…4.5
- CVE-2025-10768A flaw has been found in h2oai h2o-3 up to 3.46.08. The impa…9.8
- CVE-2025-10769A vulnerability has been found in h2oai h2o-3 up to 3.46.08.…9.8
- CVE-2025-1077A security vulnerability has been identified in the IBL Soft…9.5
- CVE-2025-10770A vulnerability was found in jeecgboot JimuReport up to 2.1.…6.5
- CVE-2025-10772A vulnerability was identified in huggingface LeRobot up to …6.3
- CVE-2025-10773A security flaw has been discovered in B-Link BL-AC2100 up t…8.8
- CVE-2025-10774A weakness has been identified in Ruijie 6000-E10 up to 2.4.…4.7
- CVE-2025-10775A security vulnerability has been detected in Wavlink WL-NU5…7.2
- CVE-2025-10776A vulnerability was detected in LionCoders SalePro POS up to…3.7
- CVE-2025-10777A flaw has been found in JSC R7 R7-Office Document Server up…6.3
Are you affected by CVE-2025-10771?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST