CVE-2026-75330: SQL Injection
Published Aug 26, 2026
·Updated
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
Affected Software
1 affected component
super-diamond-server<=1.3.3
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·11:17 PM
Description
Frequently Asked Questions
1
Which deployments are exposed?
Deployments running super-diamond-server version 1.3.3 or earlier are identified as affected if the /superdiamond/preview/{projectCode}/{module}/{type} front-end endpoint is available.
2
What input must an attacker control?
An attacker needs to supply a crafted value for the module path parameter. That value reaches a SQL IN clause through string splitting and concatenation rather than parameterized binding.