CVE-2026-11464

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11464
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11464.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11464
Published
2026-06-07T22:30:11.876Z
Modified
2026-08-12T03:51:18.105827462Z
Severity
  • 1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure
Details

A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modules\system\controller\SysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-284"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11464.json"
}
References

Affected packages

Git / github.com/jeecgboot/jeecgboot

Affected ranges

Type
GIT
Repo
https://github.com/jeecgboot/jeecgboot
Events
Introduced
41877a6e8ba6e485bdd25e6dc5d6279e58754707
Last affected
7df07a823fd558be857d0208ccae96342539fbc1
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.0"
        },
        {
            "introduced": "3.9.1"
        },
        {
            "last_affected": "3.9.1"
        },
        {
            "introduced": "3.9.2"
        },
        {
            "last_affected": "3.9.2"
        }
    ]
}

Affected versions

3.*
3.9.0
3.9.1
3.9.2
v3.*
v3.9.0last
v3.9.1
v3.9.1last
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11464.json"