Medium severity · published Apr 28, 2026
CVE-2026-7290
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
JeecgBoot ·
3.9.0; 3.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7290
github.com
https://github.com/jeecgai/JeecgBoot/commit/a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b
github.com
https://github.com/jeecgboot/JeecgBoot/
github.com
https://github.com/jeecgboot/JeecgBoot/issues/9491
github.com
https://github.com/jeecgboot/JeecgBoot/pull/9493
vuldb.com
https://vuldb.com/submit/803072
vuldb.com
https://vuldb.com/vuln/359948
More from JeecgBoot
8.8
CVE-2026-2822
JeecgBoot Backend airag_app,1,create_by sql injection
8.8
CVE-2026-1746
JeecgBoot Online Report API loadDictItemByKeyword sql injection
8.8
CVE-2025-10707
JeecgBoot sendMsg improper authorization
8.8
CVE-2025-10318
JeecgBoot WebSocket Message sendWebSocketMsg improper authorization
8.1
CVE-2025-14909
JeecgBoot SysUserOnlineController.java SysUserOnlineController user session