Back
CVE-2025-9796
thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting
Medium5.1EPSS 0.38%
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| VulDBCNA (assigner) | 3.1 | Low3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| VulDBCNA (assigner) | 3.0 | Low3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| VulDBCNA (assigner) | 2.0 | Medium4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C |
| NVDNVD · Analyzed | 4.0 | Low2.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.38% · top 68% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Weakness
Affected products
References (8)
- VDB-322111 | thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting (opens in a new tab)vdb-entrytechnical-description
- VDB-322111 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
- Submit #641125 | thinkgem https://github.com/thinkgem/jeesite5 <=v5.12.1 XSS (opens in a new tab)third-party-advisory
- https://github.com/thinkgem/jeesite5/issues/33 (opens in a new tab)issue-trackingexploit
- https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560 (opens in a new tab)issue-trackingexploit
- https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533 (opens in a new tab)exploitissue-tracking
- https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b (opens in a new tab)patch
- https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3 (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-9796)Record last updated .