CVE-2026-112017

MEDIUM 6.5

JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.

CWE	CWE-89
Vendor	jeecgboot
Product	jeecgboot
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for jeecgboot jeecgboot

Be the first to know when new medium vulnerabilities affecting jeecgboot jeecgboot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

jeecgboot / JeecgBoot

0 < 3.9.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jeecgboot/JeecgBoot/issues/9677 github.com: https://github.com/jeecgboot/JeecgBoot/blob/v3.9.2/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L269-L305 github.com: https://github.com/jeecgboot/JeecgBoot/commit/a2be896f753936956ee6863b632b8e5a0231345c github.com: https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.5 github.com: https://github.com/jeecgboot/JeecgBoot vulncheck.com: https://www.vulncheck.com/advisories/jeecgboot-before-3.9.5-sql-injection-via-sqlinjectionutil-newline-bypass

Credits

Fiona lza