Medium severity · published Sep 21, 2025
CVE-2025-10770
jeecgboot JimuReport MySQL JDBC testConnection deserialization
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the component MySQL JDBC Handler. Performing manipulation results in deserialization. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
JimuReport · jeecgboot
2.1.0; 2.1.1; 2.1.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10770
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10770
Exploit
https://github.com/jeecgboot/jimureport/issues/4116
Exploit
https://github.com/jeecgboot/jimureport/issues/4116#issue-3391107887
Permissions Required
https://vuldb.com/?ctiid.325126
Third Party Advisory
https://vuldb.com/?id.325126
Third Party Advisory
https://vuldb.com/?submit.649755
More from JimuReport
9.8
CVE-2025-10771
jeecgboot JimuReport DB2 JDBC testConnection deserialization
9.8
CVE-2025-8963
jeecgboot JimuReport Data Large Screen Template testConnection deserialization
7.5
CVE-2026-75479
JimuReport Unauthenticated Report Listing and Share Token Disclosure
7.5
CVE-2026-58375
JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
4.7
CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection