CVE-2026-124555 · Package
NO FIX YET
JeecgBoot 3.9.5 has an SQL injection flaw in the Table Dictionary API at /jeecg-boot/jmreport/form/getTableDictList, where the searchSql argument is not sanitized. A remote attacker can run arbitrary SQL against the application database, and a public exploit has been released.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
JeecgBoot 3.9.5 deployments that expose the jmreport form endpoint over the network are exposed. Instances that do not run this version, or that block the endpoint from untrusted networks, are less exposed. The sources do not state whether the flaw needs an account.
Not affected if endpoint-blocked, other-version
Who cares java, jeecgboot, self-hosted
3.9.5 (look in the project's pom.xml or package.json, or the deployed build)./jeecg-boot/jmreport/form/getTableDictList is reachable from outside your network.No fix yet, per the sources.
A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.