CVE-2021-48015High· 7.5▾ TwilightJeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
JeeWMS >= 194f221776cfcfd838abab7107b1a8352ea2bc59 < 0a610e8178a0a1197e9c6615b58faf67c406d2bcRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108781Medium· 6.3A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39
CVE-2026-108782Medium· 6.3A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39
CVE-2026-108775Medium· 6.3A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39
CVE-2026-108777Medium· 6.3A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39
CVE-2026-108778Medium· 6.3A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39
CVE-2026-108779Medium· 6.3A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39