CVE-2026-3672

2.1 lowEPSS 0.2%

Low (2.1). EPSS 0.2% chance of exploitation in the next 30 days.

A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such manipulation leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-03-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://vuldb.com/?ctiid.349569
https://vuldb.com/?id.349569
https://vuldb.com/?submit.765093
https://www.yuque.com/la12138/pa2fpb/ab1i8wyeeg1zzgq5?singleDoc

Check your stack JSON