CVE-2025-14909 | THREATINT

Description

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.

PUBLISHED Reserved 2025-12-18 | Published 2025-12-19 | Updated 2025-12-19 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

4.0AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C

Problem types

Manage User Sessions

Timeline

2025-12-18:	Advisory disclosed
2025-12-18:	VulDB entry created
2025-12-18:	VulDB entry last update

Credits

aibot88 (VulDB User) reporter

References

vuldb.com/?id.337433 (VDB-337433 | JeecgBoot SysUserOnlineController.java SysUserOnlineController user session) vdb-entry technical-description

vuldb.com/?ctiid.337433 (VDB-337433 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.715743 (Submit #715743 | jeecgboot 3.9.0 bfla) third-party-advisory

github.com/jeecgboot/JeecgBoot/issues/9195 issue-tracking

github.com/jeecgboot/JeecgBoot/issues/9195 exploit issue-tracking

github.com/...ommit/b686f9fbd1917edffe5922c6362c817a9361cfbd patch

cve.org (CVE-2025-14909)

nvd.nist.gov (CVE-2025-14909)

Download JSON