CVE-2025-14674

A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.

• CWE-74
• CWE-707

• https://gitee.com/aizuda/snail-job/
• https://gitee.com/aizuda/snail-job/commit/978f316c38b3d68bb74d2489b5e5f721f6675e86
• https://gitee.com/aizuda/snail-job/issues/ICNUG0
• https://gitee.com/aizuda/snail-job/issues/ICNUG0#note_44321424_link
• https://gitee.com/aizuda/snail-job/releases/tag/vsj1.7.0-beta1
• https://vuldb.com/?ctiid.336403
• https://vuldb.com/?id.336403

Published

Dec 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14666A weakness has been identified in itsourcecode COVID Trackin…9.8
• CVE-2025-14667A security vulnerability has been detected in itsourcecode C…9.8
• CVE-2025-14668A vulnerability was detected in campcodes Advanced Online Ex…9.8
• CVE-2025-1467Versions of the package tarteaucitronjs before 1.17.0 are vu…6.1
• CVE-2025-14672A flaw has been found in gmg137 snap7-rs up to 1.142.1. This…9.8
• CVE-2025-14673A vulnerability has been found in gmg137 snap7-rs up to 1.14…9.8
• CVE-2025-14675The Meta Box plugin for WordPress is vulnerable to arbitrary…7.2
• CVE-2025-1468An unauthenticated remote attacker can gain access to sensit…7.5
• CVE-2025-14684IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8…3.3
• CVE-2025-14687IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow …6.5
• CVE-2025-14688IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for…5.3
• CVE-2025-14689IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…6.5