What is the CVSS score of CVE-2026-52476?

CVE-2026-52476 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Java are affected by CVE-2026-52476?

AiFlowy 2.1.2 and earlier contains an unauthenticated SQL injection vulnerability allowing attackers to extract sensitive database contents without credentials, creating immediate data breach risk…

How to fix or mitigate CVE-2026-52476?

Within 24 hours: Identify all AiFlowy instances running version 2.1.2 or earlier in production and staging; immediately deploy WAF rules blocking SQL injection patterns targeting the DatacenterQuery.java getPageData method. Within 7 days: Review database access logs for anomalous getPageData requests; implement network segmentation restricting database access to trusted internal sources only; establish continuous database activity monitoring for suspicious query patterns. Within 30 days: Execute upgrade to AiFlowy 2.3.0 or verify release of patched version from vendor; if upgrade unfeasible, replace affected application components with alternative architecture that eliminates direct exposed database query access.

Java CVE-2026-52476

HIGH

SQL Injection (CWE-89)

2026-07-21 mitre

Java SQLi N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 17:24 vuln.today

CVSS changed

Jul 22, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jul 21, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file

AnalysisAI

SQL injection in AiFlowy versions 2.1.2 and earlier lets remote attackers extract sensitive database contents through the getPageData method in DatacenterQuery.java. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with high confidentiality impact but no integrity or availability effect. A public technical write-up with reproduction details exists on GitHub, though the low EPSS score (0.19%, 8th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.