CVE-2026-124555: JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection
A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the supplied CVSS vector indicates low privileges are required. No user interaction is required.
Which component and input should defenders prioritize for investigation?
Investigate the Table Dictionary API endpoint at /jeecg-boot/jmreport/form/getTableDictList, specifically handling of the searchSql argument in JimuFormApiService.getTableDictList.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and could be used in attacks.
What versions are confirmed affected?
JeecgBoot 3.9.5 is identified as affected. The provided information does not establish whether earlier or later versions are affected.