CVE-2026-3672
A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such manipulation leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- Score
- CVSS 3.1 6.3 Medium
- Status
- Deferred - cna@vuldb.com
- Published
- 2026-03-07
- Last modified
- 2026-03-11
- Weaknesses
- CWE-74, CWE-89
References
- https://vuldb.com/?ctiid.349569
- https://vuldb.com/?id.349569
- https://vuldb.com/?submit.765093
- https://www.yuque.com/la12138/pa2fpb/ab1i8wyeeg1zzgq5?singleDoc
