MEDIUM
thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting
Published Sep 1, 2025
5.1
MEDIUMCVSS 4.0
EPSS 0.36%
Description
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.
Affected products
-
- Version 5.12.0StatusaffectedConstraints-
- Version 5.12.1StatusaffectedConstraints-
- Version 5.13.0StatusunaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (9)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26363 Advisory
- https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b patch
- https://github.com/thinkgem/jeesite5/issues/33 exploitissue-trackingIssue Tracking
- https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533 exploitissue-trackingIssue Tracking
- https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560 exploitissue-trackingIssue Tracking
- https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3 patchRelease Notes
- https://vuldb.com/?ctiid.322111 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.322111 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.641125 third-party-advisoryThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26363 | Advisory | |
| https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b | patch | |
| https://github.com/thinkgem/jeesite5/issues/33 | exploitissue-trackingIssue Tracking | |
| https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533 | exploitissue-trackingIssue Tracking | |
| https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560 | exploitissue-trackingIssue Tracking | |
| https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3 | patchRelease Notes | |
| https://vuldb.com/?ctiid.322111 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.322111 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.641125 | third-party-advisoryThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Sep 1, 2025
Updated Sep 2, 2025
Reserved Sep 1, 2025
Link CVE-2025-9796
CISA Vulnrichment
Updated Sep 2, 2025
ENISA EUVD
EUVD-2025-26363 Assigner VulDB
Published Sep 1, 2025
Updated Sep 2, 2025
Exploited since n/a
Link EUVD-2025-26363