CVE-2026-7290

Description

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.

References

https://vuldb.com/vuln/359948/cti

https://vuldb.com/vuln/359948

https://vuldb.com/submit/803072

https://github.com/jeecgboot/JeecgBoot/pull/9493

https://github.com/jeecgboot/JeecgBoot/issues/9491

https://github.com/jeecgboot/JeecgBoot/

https://github.com/jeecgai/JeecgBoot/commit/a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4