CVE-2023-1454

criticalpriority · attend · 62EPSS 0.361 · 98 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

7 exploits · PoC

Likely / severe?

36.1% (98th) EPSS

CVSS 9.8 · critical

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-28

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.3–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Psecondary · cna@vuldb.comexploitability 8 · impact 6.4

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · cna@vuldb.comexploitability 2.8 · impact 3.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-89USCWE-89US

exploits (7)

Public proof-of-concept and weaponised exploit code.

BugFor-Pings/CVE-2023-1454CVE-2023-1454漏洞检测脚本PoC · poc_in_github
P4x1s/CVE-2023-1454-EXPCVE-2023-1454 jeecg-boot Unauthorized SQL injection vulnerabilityPoC · poc_in_github
Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvulnjmreport/qurestSql 未授权SQL注入批量扫描poc Jeecg-Boot是一款基于Spring Boot和Jeecg-Boot-Plus的快速开发平台，最新的jeecg-boot 3.5.0 中被爆出多个SQL注入漏洞。PoC · poc_in_github
cjybao/CVE-2023-1454jmreport/qurestSql 未授权SQL注入批量扫描pocPoC · poc_in_github
gobysec/CVE-2023-1454jeecg-boot unauthorized SQL Injection Vulnerability (CVE-2023-1454)PoC · poc_in_github
padbergpete47/CVE-2023-1454CVE-2023-1454,Jeecg-Boot 前台SQL注入,CVE-2023-1454批量检测PoC · poc_in_github

affected products (3)

Products and version ranges known to be affected.

n/a jeecg-boot≤ 3.5.0enisa_euvdEU
jeecg jeecg boot= 3.5.0nvdUScpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Maven org.jeecgframework.boot:jeecg-boot-common≤ 3.5.0osvUSpkg:maven/org.jeecgframework.boot/jeecg-boot-common

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-j72f-4hgp-3mwcjeecg-boot SQL Injection vulnerability2023-03-17ghsa · osvUS
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2023-03-17modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan