CVE-2026-67925

MediumCVSS 6.1

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload.

An attacker can hijack user sessions or execute malicious scripts in the victim's browser, potentially leading to data theft or unauthorized actions.

Update JeecgBoot to the latest version and apply input filtering and output encoding for data sent to the /airag/chat/upload endpoint.

Original NVD description (English source)

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload