Skip to content
Sign in
5.3 Medium

CVE-2026-124555 JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection

Description

A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
JeecgBoot 3.9.5 No fix stated

Other CVEs of JeecgBoot

The 49 CVEs of JeecgBoot →
CVE-2026-124554 JeecgBoot JimuBI getAllChartData sql injection 6.9 Medium CVE-2026-86228 A security vulnerability has been detected in JeecgBoot up to 3.9.3 5.3 Medium CVE-2026-19000 A vulnerability was identified in JeecgBoot up to 3.9.2 6.9 Medium CVE-2026-11502 A weakness has been identified in JeecgBoot up to 3.9.2 2.3 Low
Track this CVE