CVE-2026-2945

A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the file /sys/common/uploadImgByHttp. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-918

• https://vuldb.com/?ctiid.347315Permissions Required, VDB Entry
• https://vuldb.com/?id.347315Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.754590Third Party Advisory, VDB Entry
• https://www.yuque.com/la12138/vxbwk9/glws4ppukxqtpfhl?singleDocExploit, Third Party Advisory

Published

Feb 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2939A vulnerability was found in itsourcecode Student Management…4.8
• CVE-2026-2940A vulnerability was determined in Zaher1307 tiny_web_server …7.3
• CVE-2026-2941The Linksy Search and Replace plugin for WordPress is vulner…8.8
• CVE-2026-2942The ProSolution WP Client plugin for WordPress is vulnerable…9.8
• CVE-2026-2943A vulnerability was identified in SapneshNaik Student Manage…4.3
• CVE-2026-2944A security flaw has been discovered in Tosei Online Store Ma…9.8
• CVE-2026-2946A security vulnerability has been detected in rymcu forest u…5.4
• CVE-2026-2947A vulnerability was detected in rymcu forest up to 0.0.5. Th…5.4
• CVE-2026-2948The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecos…6.4
• CVE-2026-2949The Xpro Addons — 140+ Widgets for Elementor plugin for Word…6.4
• CVE-2026-2950Impact: Lodash versions 4.17.23 and earlier are vulnerable …5.3
• CVE-2026-29509Patool before 4.0.5 contains a path traversal vulnerability …5.4