CVE Feed

    Dashboard / CVE / CVE-2021-48015

    CVE-2021-48015

    JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

    Published:Oct 22, 2026
    Last Modified:Oct 22, 2026
    EPS:Oct 22, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Erzhongxmu
    Product
    Jeewms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-108782 (CVSS 2.1) — A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the functi…
    CVE-2026-108781 (CVSS 2.1) — A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability …
    CVE-2026-108779 (CVSS 2.1) — A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGood…
    CVE-2026-108778 (CVSS 2.1) — A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmICon…
    CVE-2026-108777 (CVSS 2.1) — A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.…
    CVE-2026-108774 (CVSS 2.1) — A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinal…
    CVE-2026-11458 (CVSS 5.5) — A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue…
    CVE-2026-11457 (CVSS 5.5) — A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This …
    CVE-2026-3026 (CVSS 5.5) — A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality …
    CVE-2025-70311 (CVSS 6.5) — JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and i…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High