What is the CVSS score of CVE-2026-52348?

CVE-2026-52348 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of cool-admin-java are affected by CVE-2026-52348?

cool-admin-java 8.0.0 contains a critical SQL injection vulnerability allowing unauthenticated attackers to access and modify the entire database.

How to fix or mitigate CVE-2026-52348?

Within 24 hours: Identify and inventory all systems running cool-admin-java 8.0.0; implement firewall or Web Application Firewall rules to restrict access to affected CRUD endpoints; review recent database access logs for exploitation attempts. Within 7 days: Deploy WAF rules to block SQL injection payloads targeting the order() method; audit and tighten database account permissions; document all affected systems and establish remediation timeline. Within 30 days: Monitor for vendor patch release and immediately upgrade all cool-admin-java 8.0.0 instances to the patched version; implement continuous monitoring and alerting for SQL injection attempts.

cool-admin-java CVE-2026-52348

CRITICAL

SQL Injection (CWE-89)

2026-07-17 mitre

Java SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SQLi with low complexity gives full C/I/A impact, but the affected CRUD admin endpoint most likely requires an authenticated session, so PR:L rather than the NVD's PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:24 vuln.today

CVSS changed

Jul 20, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 17, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

AnalysisAI

SQL injection in cool-admin-java 8.0.0 lets attackers inject arbitrary SQL through the order() method of CrudOption.java, a shared CRUD helper used across the framework's auto-generated data endpoints. The flaw carries an NVD CVSS of 9.8 (CWE-89) and, if reachable without authentication as the vector implies, permits full read/write access to the backing database. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile), indicating minimal observed exploitation activity so far.

Technical ContextAI

cool-admin-java is an open-source Java rapid-development admin/backend framework (Spring-based) that auto-generates CRUD REST endpoints. CrudOption.java is the configuration/helper class that builds list-query options; its order() method assembles the ORDER BY / sorting portion of the generated SQL. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a client-controlled sort/order parameter is concatenated into the query rather than validated against an allow-list or bound as a parameter. Because ORDER BY clauses cannot be parameterized with standard prepared-statement placeholders, frameworks must whitelist column names - failure to do so is a classic injection sink. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not enumerate real product/version data.

RemediationAI

No vendor-released patch identified at time of analysis; the sole reference (GitHub issue #19 at https://github.com/cool-team-official/cool-admin-java/issues/19) is a bug report, not a tagged patched release, so upgrade guidance cannot cite a confirmed fix version - monitor that issue and the cool-team-official/cool-admin-java releases for a patched build above 8.0.0. As compensating controls until a fix ships: enforce a strict server-side allow-list of sortable column names in the order()/CrudOption code path so only known columns and ASC/DESC pass (the most direct fix, no functional loss for legitimate sorts); require and verify authentication/authorization on all auto-generated CRUD list endpoints (side effect: none if they were meant to be admin-only); and place a WAF or input filter in front of the sort/order query parameters to block SQL meta-characters (trade-off: may break legitimate multi-column sort syntax and offers only partial coverage). Restrict network access to the admin backend to trusted operators to reduce exposure while a patch is pending.