CVE-2026-75330

Name of the Vulnerable Software and Affected Versions super-diamond-server versions prior to 1.3.4

Description The front-end interface '/superdiamond/preview/{projectCode}/{module}/{type}' is susceptible to SQL injection. This occurs because the module parameter is directly concatenated into a SQL IN clause using StringUtils.split() and string concatenation, rather than being parameterized and bound.

Recommendations Update super-diamond-server to version 1.3.4 or later. As a temporary mitigation, restrict access to the '/superdiamond/preview/{projectCode}/{module}/{type}' endpoint or avoid using the module parameter until the update is applied.