CVE-2026-7290

JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection

CVSS 5.3 MEDIUMEPSS 0.2%CWE-74 CWE-89

Vexday Risk Score

33Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Prova de conceito

Existe prova de conceito pública, mas ainda não automatizada.

CVSS 5.3EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Ciclo de vida

28 abr 2026Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

n/a · JeecgBoot

PoCs públicas encontradas — 1

cve_referencegithub.com/jeecgboot/JeecgBoot/issues/9491não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

https://github.com/jeecgai/JeecgBoot/commit/a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b https://github.com/jeecgboot/JeecgBoot/https://github.com/jeecgboot/JeecgBoot/issues/9491 https://github.com/jeecgboot/JeecgBoot/pull/9493 https://vuldb.com/submit/803072 https://vuldb.com/vuln/359948 https://vuldb.com/vuln/359948/cti