CVE-2025-9796

LOW EPSS 24.5%
Published Sep 1, 202510mo ago · Modified Jun 17, 20261w ago
2.0 CVSS 4.0
Low
Find Similar
Published Sep 1, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.

CVSS Details

Base Score
2.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
24.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-94 Improper Control of Generation of Code (Code Injection) Injection

Affected Products 1

VendorProductVersionRange
jeesitejeesite* <5.13.0

References 8

  • github.com https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b
    Patch
  • github.com https://github.com/thinkgem/jeesite5/issues/33
    ExploitIssue Tracking
  • github.com https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533
    ExploitIssue Tracking
  • github.com https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560
    ExploitIssue Tracking
  • github.com https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3
    Release Notes
  • vuldb.com https://vuldb.com/?ctiid.322111
    Permissions RequiredVDB Entry
  • vuldb.com https://vuldb.com/?id.322111
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.641125
    Third Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b
    Patch