CVE-2026-112017
Last modified
CVE-2026-112017 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user..
Description
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jeecgboot | JeecgBoot | < 3.9.5 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-112017?
How severe is CVE-2026-112017?
How do I fix CVE-2026-112017?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-112011libtta through 2.3 contains an integer overflow vulnerabilit…5.3
- CVE-2026-112012libtta through 2.3 contains a stack out-of-bounds read and w…5.3
- CVE-2026-112013libtta through 2.3 contains a divide-by-zero vulnerability i…5.5
- CVE-2026-112014LobsterAI before 2026.10.16 contains a hardcoded password vu…5.5
- CVE-2026-112015Omnigent 0.3.0 before 0.14.0 contains a path traversal vulne…7.5
- CVE-2026-112016Netcore NR256CN through 1.5.140116 contains an unauthenticat…6.5
- CVE-2026-112018cgltf through 1.15 contains a heap out-of-bounds write vulne…7
- CVE-2026-112019cgltf through 1.15 contains a heap out-of-bounds read vulner…6.1
- CVE-2026-11202Inappropriate implementation in Chrome for iOS in Google Chr…8.8
- CVE-2026-112020LodePNG through 20261006 contains a heap out-of-bounds read …6.1
- CVE-2026-112021snac2 before 2.93 contains a heap-based buffer overflow vuln…7.5
- CVE-2026-11203Inappropriate implementation in GPU in Google Chrome on Mac …6.5
Are you affected by CVE-2026-112017?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST