CVE-2025-14909

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.

• CWE-1018

• https://github.com/jeecgboot/JeecgBoot/commit/b686f9fbd1917edffe5922c6362c817a9361cfbdPatch
• https://github.com/jeecgboot/JeecgBoot/issues/9195Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jeecgboot/JeecgBoot/issues/9195#issue-3719368751Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.337433Permissions Required, VDB Entry
• https://vuldb.com/?id.337433Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.715743Exploit, Third Party Advisory, VDB Entry

Published

Dec 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14903The Simple Crypto Shortcodes plugin for WordPress is vulnera…4.3
• CVE-2025-14904The Newsletter Email Subscribe plugin for WordPress is vulne…4.3
• CVE-2025-14905A flaw was found in the 389-ds-base server. A heap buffer ov…7.2
• CVE-2025-14906The WP Youtube Video Gallery plugin for WordPress is vulnera…4.3
• CVE-2025-14907The Moderate Selected Posts plugin for WordPress is vulnerab…4.3
• CVE-2025-14908A security flaw has been discovered in JeecgBoot up to 3.9.0…8.1
• CVE-2025-1491The WP Posts Carousel plugin for WordPress is vulnerable to …6.4
• CVE-2025-14910A vulnerability was detected in Edimax BR-6208AC 1.02. This …6.5
• CVE-2025-14911User-controlled chunkSize metadata from MongoDB lacks approp…7.1
• CVE-2025-14912IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …5.4
• CVE-2025-14913The Frontend Post Submission Manager Lite – Frontend Posting…5.3
• CVE-2025-14914IBM WebSphere Application Server Liberty 17.0.0.3 through 26…7.6