CVE-2025-66913

JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.

• CWE-94

• https://gist.github.com/Catherines77/f15d53e9705b24cf018e5bffed3e8234Third Party Advisory
• https://github.com/jeecgboot/jimureport/issues/4306Exploit, Issue Tracking, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66906Cross Site Request Forgery (CSRF) vulnerability in Turms Adm…6.1
• CVE-2025-66908Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contain…5.3
• CVE-2025-66909Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contain…7.5
• CVE-2025-6691The SureForms – Drag and Drop Form Builder for WordPress plu…8.1
• CVE-2025-66910Turms Server v0.10.0-SNAPSHOT and earlier contains a plainte…6
• CVE-2025-66911Turms IM Server v0.10.0-SNAPSHOT and earlier contains a brok…6.5
• CVE-2025-66916The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and …9.4
• CVE-2025-66918edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross…8.8
• CVE-2025-6692The YouTube Embed plugin for WordPress is vulnerable to Stor…6.4
• CVE-2025-66921A Cross-site scripting (XSS) vulnerability in Create/Update …7.2
• CVE-2025-66923A Cross-site scripting (XSS) vulnerability in Create/Update …7.2
• CVE-2025-66924A Cross-site scripting (XSS) vulnerability in Create/Update …6.1