{"id":"CVE-2026-124555","kind":"vulnerability","aliases":["CVE-2026-124555"],"related":[],"title":"JeecgBoot: SQL injection in table dictionary API lets attackers query the database","description":"A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"JeecgBoot 3.9.5 has an SQL injection flaw in the Table Dictionary API at /jeecg-boot/jmreport/form/getTableDictList, where the searchSql argument is not sanitized. A remote attacker can run arbitrary SQL against the application database, and a public exploit has been released.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jeecgboot","package","self-hosted"],"not_affected_if":["endpoint-blocked","other-version"],"how_to_check":"- Check whether the running JeecgBoot version is `3.9.5` (look in the project's pom.xml or package.json, or the deployed build).\n- Test whether the endpoint `/jeecg-boot/jmreport/form/getTableDictList` is reachable from outside your network.","fix":null,"status":"open","published_at":"2026-11-09T02:16:59+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","triaged_at":"2026-11-09T02:26:24+00:00","updated_at":"2026-11-09T02:26:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T02:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JeecgBoot: SQL injection in table dictionary API lets attackers query the database","impact":"high","summary":"JeecgBoot 3.9.5 has an SQL injection flaw in the Table Dictionary API at /jeecg-boot/jmreport/form/getTableDictList, where the searchSql argument is not sanitized. A remote attacker can run arbitrary SQL against the application database, and a public exploit has been released.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jeecgboot","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or changes database contents remotely","analyst_note":"Check the NVD entry and the vendor or project repository for the fixed version and whether authentication is required; the sources give no fix.","how_to_check":"- Check whether the running JeecgBoot version is `3.9.5` (look in the project's pom.xml or package.json, or the deployed build).\n- Test whether the endpoint `/jeecg-boot/jmreport/form/getTableDictList` is reachable from outside your network.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-version","endpoint-blocked"],"who_is_affected":"JeecgBoot 3.9.5 deployments that expose the jmreport form endpoint over the network are exposed. Instances that do not run this version, or that block the endpoint from untrusted networks, are less exposed. The sources do not state whether the flaw needs an account.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4603,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124555':15A,18A '-2026':14A,17A '/jeecg-boot/jmreport/form/gettabledictlist':38B,81C '3.9.5':26B,71C 'affect':74C 'api':7A,36B,87C 'applic':55B 'arbitrari':51B 'argument':42B,93C 'attack':9A,48B,101C,120C 'avail':111C 'compon':84C 'contact':124C 'could':116C 'cve':13A,16A 'databas':12A,56B 'dictionari':6A,35B,86C 'disclosur':128C 'earli':125C 'execut':88C,104C 'exploit':60B,107C 'file':80C 'flaw':31B 'function':76C 'host':24B 'identifi':68C 'inject':3A,30B,99C 'java':19B 'jeecgboot':1A,20B,25B,70C 'jimuformapiservice.gettabledictlist':77C 'lead':96C 'let':8A 'made':110C 'manipul':90C 'packag':21B 'public':59B,114C 'queri':10A 'releas':63B 'remot':47B,105C 'respond':132C 'run':50B 'sanit':45B 'searchsql':41B,94C 'self':23B 'self-host':22B 'sql':2A,29B,52B,98C 'tabl':5A,34B,85C 'use':118C 'vendor':122C 'vulner':73C 'way':135C 'weak':65C","nicknames":[],"mitigations":[],"who_affected":"JeecgBoot 3.9.5 deployments that expose the jmreport form endpoint over the network are exposed. Instances that do not run this version, or that block the endpoint from untrusted networks, are less exposed. The sources do not state whether the flaw needs an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","jeecgboot","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124555':15A,18A '-2026':14A,17A 'api':7A 'attack':9A 'cve':13A,16A 'databas':12A 'dictionari':6A 'inject':3A 'jeecgboot':1A 'let':8A 'queri':10A 'sql':2A 'tabl':5A","search_b":"'/jeecg-boot/jmreport/form/gettabledictlist':38B '3.9.5':26B 'api':36B 'applic':55B 'arbitrari':51B 'argument':42B 'attack':48B 'databas':56B 'dictionari':35B 'exploit':60B 'flaw':31B 'host':24B 'inject':30B 'java':19B 'jeecgboot':20B,25B 'packag':21B 'public':59B 'releas':63B 'remot':47B 'run':50B 'sanit':45B 'searchsql':41B 'self':23B 'self-host':22B 'sql':29B,52B 'tabl':34B","search_c":"'/jeecg-boot/jmreport/form/gettabledictlist':81C '3.9.5':71C 'affect':74C 'api':87C 'argument':93C 'attack':101C,120C 'avail':111C 'compon':84C 'contact':124C 'could':116C 'dictionari':86C 'disclosur':128C 'earli':125C 'execut':88C,104C 'exploit':107C 'file':80C 'function':76C 'identifi':68C 'inject':99C 'jeecgboot':70C 'jimuformapiservice.gettabledictlist':77C 'lead':96C 'made':110C 'manipul':90C 'public':114C 'remot':105C 'respond':132C 'searchsql':94C 'sql':98C 'tabl':85C 'use':118C 'vendor':122C 'vulner':73C 'way':135C 'weak':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124555","severity":null,"published_at":"2026-11-09T02:16:59+00:00","modified_at":"2026-11-09T02:16:59+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","fetched_at":"2026-11-09T02:24:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}