High severity · published Sep 19, 2025
CVE-2025-10707
JeecgBoot sendMsg improper authorization
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
JeecgBoot ·
3.8.0; 3.8.1; 3.8.2 · source: vendor
JB
Jeecg Boot · Jeecg
through 3.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10707
Permissions Required
https://vuldb.com/?ctiid.324995
Third Party Advisory
https://vuldb.com/?id.324995
Third Party Advisory
https://vuldb.com/?submit.644659
Exploit
https://www.cnblogs.com/aibot/p/19063346
More from JeecgBoot
8.8
CVE-2026-2822
JeecgBoot Backend airag_app,1,create_by sql injection
8.8
CVE-2026-1746
JeecgBoot Online Report API loadDictItemByKeyword sql injection
8.8
CVE-2025-10318
JeecgBoot WebSocket Message sendWebSocketMsg improper authorization
8.1
CVE-2025-14909
JeecgBoot SysUserOnlineController.java SysUserOnlineController user session
8.1
CVE-2025-14908
JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication