CVE-2026-7290

MEDIUM

JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-359948 | JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
https://vuldb.com/vuln/359948
Signature, Permissions Required signature permissions-required
VDB-359948 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359948/cti
Third Party Advisory third-party-advisory
Submit #803072 | JEECG JeecgBoot v3.9.1 SQL Injection
https://vuldb.com/submit/803072

Scores

CVSS v3 6.3
EPSS 0.0020
EPSS Percentile 10.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (2)
None/JeecgBoot 3.9.0
None/JeecgBoot 3.9.1
Published Apr 28, 2026
Tracked Since Apr 29, 2026