A flaw in the DriverManager.getConnection function of the Data Source Handler component in jeecgboot JimuReport allows an attacker to inject code through manipulation of the dbUrl argument. This can lead to execution of arbitrary code on the host system, potentially compromising confidentiality, integrity, and availability of data and services. The vulnerability is identified as CWE‑74 and CWE‑94.

Any installation of jeecgboot JimuReport up to and including version 2.3.0 is affected. The issue resides in the testConnection routine used to establish database connections, so systems that expose this functionality to external inputs are at risk. Operators should verify the version in use and consider whether database URLs can be influenced by untrusted users.

The CVSS score of 5.1 indicates moderate severity. The exploit has been made public and can be triggered remotely by supplying a crafted dbUrl. Because the code executes the supplied argument, successful exploitation results in remote code execution. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the publicly disclosed nature of the exploit and the potential impact elevate the risk, especially for environments that cannot be patched immediately.