CVE-2026-7290
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.
| CWE | CWE-89 CWE-74 |
| Vendor | n/a |
| Product | jeecgboot |
| Published | Apr 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a jeecgboot
Be the first to know when new medium vulnerabilities affecting n/a jeecgboot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / JeecgBoot
3.9.0 3.9.1
References
vuldb.com: https://vuldb.com/vuln/359948 vuldb.com: https://vuldb.com/vuln/359948/cti vuldb.com: https://vuldb.com/submit/803072 github.com: https://github.com/jeecgboot/JeecgBoot/issues/9491 github.com: https://github.com/jeecgboot/JeecgBoot/pull/9493 github.com: https://github.com/jeecgai/JeecgBoot/commit/a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b github.com: https://github.com/jeecgboot/JeecgBoot/
Credits
🔍 larlarua (VulDB User)