Is there a public PoC exploit available for CVE-2026-7290?

Yes, a public proof-of-concept exploit is available for CVE-2026-7290. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-7290?

Yes, a patch is available for CVE-2026-7290. Update the affected software to the latest version immediately.

JeecgBoot CVE-2026-7290

Q: What is the CVSS score of CVE-2026-7290?

CVE-2026-7290 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26072 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 19:52 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 19:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 18:45 euvd

EUVD-2026-26072

Analysis Generated

Apr 28, 2026 - 18:45 vuln.today

Patch released

Apr 28, 2026 - 18:45 nvd

Patch available

CVE Published

Apr 28, 2026 - 16:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

SQL injection in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to execute arbitrary SQL commands through the loadDict endpoint by manipulating the keyword parameter in the SqlInjectionUtil function. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector, and publicly available exploit code exists; patch availability is confirmed via GitHub commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b.

Technical ContextAI

JeecgBoot is a Java-based low-code rapid development framework. The vulnerability exists in the SqlInjectionUtil class within jeecg-boot-base-core, specifically in the loadDict endpoint handler. The root cause is improper input validation and parameterization of SQL queries (CWE-89), allowing an attacker to inject arbitrary SQL syntax through the keyword parameter. The affected component processes dictionary loading requests, a common operation in database-driven applications, making this endpoint frequently exposed in typical JeecgBoot deployments.

RemediationAI

Deploy the patched version containing commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b, available via GitHub pull request #9493 on the JeecgBoot repository. If immediate patching is not feasible, implement network-level access controls to restrict access to the loadDict endpoint to trusted application servers only, and enforce strong authentication policies to minimize the risk of credential compromise. Additionally, enable SQL query logging and intrusion detection for the dictionary loading function to detect injection attempts. Review application logs for suspicious keyword parameter values containing SQL metacharacters (such as single quotes, semicolons, or UNION operators). Note that network restriction has operational trade-offs if the endpoint is used by multiple internal services - coordinate with application owners before implementation. See https://github.com/jeecgboot/JeecgBoot/pull/9493 for detailed patch guidance.