CVE-2026-7290

JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection

CVSS 5.3 MEDIUMEPSS 0.2%CWE-74 CWE-89

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 5.3EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

28 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

n/a · JeecgBoot

public PoCs found — 1

cve_referencegithub.com/jeecgboot/JeecgBoot/issues/9491unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/jeecgai/JeecgBoot/commit/a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b https://github.com/jeecgboot/JeecgBoot/https://github.com/jeecgboot/JeecgBoot/issues/9491 https://github.com/jeecgboot/JeecgBoot/pull/9493 https://vuldb.com/submit/803072 https://vuldb.com/vuln/359948 https://vuldb.com/vuln/359948/cti