---
id: "CVE-2026-124555"
page: "https://infrastack.ai/live/CVE-2026-124555"
kind: "vulnerability"
aliases: ["CVE-2026-124555"]
title: "JeecgBoot: SQL injection in table dictionary API lets attackers query the database"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jeecgboot", "package", "self-hosted"]
not_affected_if: ["endpoint-blocked", "other-version"]
published_at: "2026-11-09T02:16:59+00:00"
first_seen_at: "2026-11-09T02:24:16+00:00"
updated_at: "2026-11-09T02:26:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124555", "first_seen_at": "2026-11-09T02:24:16+00:00"}]
exploit_sources: []
---

# JeecgBoot: SQL injection in table dictionary API lets attackers query the database

Link for people: https://infrastack.ai/live/CVE-2026-124555 (this .md is for agents)

JeecgBoot 3.9.5 has an SQL injection flaw in the Table Dictionary API at /jeecg-boot/jmreport/form/getTableDictList, where the searchSql argument is not sanitized. A remote attacker can run arbitrary SQL against the application database, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the running JeecgBoot version is `3.9.5` (look in the project's pom.xml or package.json, or the deployed build).
- Test whether the endpoint `/jeecg-boot/jmreport/form/getTableDictList` is reachable from outside your network.

## Timeline

- 2026-11-09T02:24:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124555

## From the sources

A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_