CVE-2026-3672: JeecgBoot getDictItems isExistSqlInjectKeyword sql injection
A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such manipulation leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3672?
CVE-2026-3672 is considered a critical vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2026-3672?
To fix CVE-2026-3672, upgrade JeecgBoot to version 3.9.2 or later where the vulnerability has been addressed.
What systems are impacted by CVE-2026-3672?
CVE-2026-3672 affects JeecgBoot versions up to and including 3.9.1.
What type of vulnerability is CVE-2026-3672?
CVE-2026-3672 is classified as a SQL injection vulnerability affecting the isExistSqlInjectKeyword function.
Can CVE-2026-3672 be exploited remotely?
Yes, CVE-2026-3672 can be exploited remotely by attackers to execute arbitrary SQL commands.