PT-2026-23883

CVE-2026-3672

Published

2026-03-07

Updated

2026-03-08

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.1

Description A flaw exists within JeecgBoot that allows for SQL injection. This issue is located in the isExistSqlInjectKeyword function within the /jeecg-boot/sys/api/getDictItems file. Successful exploitation could occur remotely. The details of the exploit have been publicly disclosed.

Recommendations Update JeecgBoot to a version beyond 3.9.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Saul1213

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')