CVE-2025-10707

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
n/a	JeecgBoot	3.8.0; 3.8.1; 3.8.2

References

https://vuldb.com/?ctiid.324995Permissions Required, VDB Entry
https://vuldb.com/?id.324995Third Party Advisory, VDB Entry
https://vuldb.com/?submit.644659Third Party Advisory, VDB Entry
https://www.cnblogs.com/aibot/p/19063346Exploit, Third Party Advisory
https://www.cnblogs.com/aibot/p/19063346Exploit, Third Party Advisory

Timeline

Published: Sep 19, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-107087.5A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is a CVE-2025-107097.5A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functional CVE-2025-10714.8A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker mo CVE-2025-107104.3A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipula CVE-2025-107114.3A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /inde CVE-2025-107127.3A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.CVE-2025-107139.1An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application CVE-2025-107148.4AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsof CVE-2025-107155.3A security flaw has been discovered in APEUni PTE Exam Practice App up to 10.8.0 on Android. The impacted element is an unknown function of CVE-2025-107165.3A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file A CVE-2025-107175.3A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of CVE-2025-107185.3A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.o