Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-9796

Good to know:

icon

Date: September 1, 2025

A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.

Severity Score

Related Resources (10)

https://vuldb.com/?id.322111
https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3
https://vuldb.com/?submit.641125
https://vuldb.com/?ctiid.322111
https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b
https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533
https://github.com/thinkgem/jeesite5/issues/33
https://nvd.nist.gov/vuln/detail/CVE-2025-9796
https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560
https://www.mend.io/vulnerability-database/CVE-2025-9796

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Improper Control of Generation of Code ('Code Injection')

CWE-94

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/thinkgem/jeesite5.git - v5.13.0.springboo3

Learn More

CVSS v3

Base Score:
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): PARTIAL

Do you need more information?

Contact Us