CVE-2026-112017

{
  "etk_id": "ETK-2026-1976",
  "cve_id": "CVE-2026-112017",
  "display_id": "CVE-2026-112017",
  "ghsa_id": "GHSA-j5cg-5m27-jqf8",
  "euvd_id": "EUVD-2026-103470",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated SQL injection in JeecgBoot",
  "summary": "JeecgBoot versions earlier than 3.9.5 are affected by an SQL injection flaw in dictionary and online report SQL handling. An authenticated attacker may bypass input filtering and read database data, including password hashes.",
  "mitigation": "Upgrade JeecgBoot to version 3.9.5 or later. Until upgraded, restrict access to affected functionality to trusted authenticated users.",
  "vendor": "jeecgboot",
  "product": "JeecgBoot",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.9.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.9.5"
      ],
      "package_name": "JeecgBoot",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0028,
  "epss_percentile": 0.1948,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 95.74986803333333,
  "t0_at": "2026-10-18T11:38:37.829000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T19:31:22.578282+00:00",
      "days": 0.3282957092824074,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:38:37.829000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-18T11:38:37.829000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:38:37.829000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112017"
    }
  }
}