CVE-2026-75334

Name of the Vulnerable Software and Affected Versions smart-web2 version 1.3.1

Description The report module in the backend allows arbitrary SQL execution. This occurs because the sqlResource.sql parameter, processed through the ReportController.save() interface and stored in the t report sql resource table, is directly embedded into Hibernate native queries without parameterization or filtering. Hibernate native queries are SQL queries written in the native dialect of the database being used, bypassing the standard abstraction layer.

Recommendations Update smart-web2 to a version that addresses this issue. As a temporary mitigation, restrict access to the ReportController.save() interface to prevent unauthorized modification of the sqlResource.sql parameter.