CVE-2023-38988
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Risk Assessment
Attackers can delete critical notifications, potentially leading to loss of important information and disruption of system operations.
Recommendation
It is recommended to update to the latest version of jeesite and implement additional access controls for the notification deletion function.
Other vulnerabilities in jeesite v1.2.6
See all- CVE-2026-36762High
JeeSite version 5.15.1 contains a vulnerability in the fileEntityId parameter in the /a/file/upload endpoint, allowing authenticated attackers with file upload permissions to perform a path traversal attack and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
- CVE-2023-38991Medium
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
Original NVD description (English source)
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS