Java CVE-2026-5736

Q: What is the CVSS score of CVE-2026-5736?

CVE-2026-5736 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19893 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-07 cna@vuldb.com

GHSA-4fp2-3xgg-jg4w

Java SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 07, 2026 - 19:22 euvd

EUVD-2026-19893

Analysis Generated

Apr 07, 2026 - 19:22 vuln.today

CVE Published

Apr 07, 2026 - 19:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in PowerJob 5.1.0 through 5.1.2 allows remote attackers to execute arbitrary SQL queries via the customQuery parameter in the detailPlus endpoint of InstanceController.java, potentially enabling unauthorized data access or modification. The vulnerability is remotely exploitable without authentication (CVSS 6.9, EPSS P), with a GitHub pull request indicating a fix is under review but not yet released as a patched version.

Technical ContextAI

PowerJob is a Java-based distributed task scheduling framework. The vulnerability exists in the detailPlus endpoint of the InstanceController component, where user-supplied input from the customQuery parameter is directly incorporated into SQL queries without proper parameterization or sanitization. This represents a CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) violation, specifically SQL injection. The affected versions (5.1.0, 5.1.1, 5.1.2) indicate the vulnerability was introduced or present in the 5.1.x release series. The Java-based architecture and web controller pattern suggest this is a server-side vulnerability in the PowerJob-Server component, likely accessible via HTTP.

RemediationAI

Upgrade PowerJob to a version containing the SQL injection fix. GitHub pull request #1166 indicates the upstream project has a proposed remediation available; monitor the project repository for a patched release version (patched version number not independently confirmed at time of analysis). As an immediate interim measure, restrict network access to the PowerJob-Server detailPlus endpoint to trusted sources only, and implement Web Application Firewall (WAF) rules to block SQL injection patterns in the customQuery parameter. Input validation and parameterized query enforcement in InstanceController.java should be applied. For current status and patched releases, consult https://github.com/PowerJob/PowerJob/ and https://github.com/PowerJob/PowerJob/pull/1166.