CVE-2025-7759

A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.

• CWE-918

• https://github.com/MentalityXt/jeesite_ssrf/tree/main
• https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdcPatch
• https://github.com/thinkgem/jeesite5/issues/27Exploit, Issue Tracking
• https://vuldb.com/?ctiid.316749Permissions Required, VDB Entry
• https://vuldb.com/?id.316749Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.615769Third Party Advisory, VDB Entry
• https://github.com/thinkgem/jeesite5/issues/27Exploit, Issue Tracking

Published

Jul 17, 2025

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7753A vulnerability was found in code-projects Online Appointmen…9.8
• CVE-2025-7754A vulnerability was found in code-projects Patient Record Ma…7.5
• CVE-2025-7755A vulnerability was found in code-projects Online Ordering S…8.8
• CVE-2025-7756A vulnerability classified as problematic has been found in …4.3
• CVE-2025-7757A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-7758A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-7760Improper Neutralization of Input During Web Page Generation …7.6
• CVE-2025-7761Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (…5.1
• CVE-2025-7762A vulnerability, which was classified as critical, has been …6.5
• CVE-2025-7763A vulnerability, which was classified as problematic, was fo…4.3
• CVE-2025-7764A vulnerability classified as critical has been found in cod…9.8
• CVE-2025-7765A vulnerability classified as critical was found in code-pro…9.8