JeecgBoot EUVD-2026-119776

Exploitation requires a network-reachable JeecgBoot 3.9.5 instance that exposes the JimuBI component's /jeecg-boot/drag/onlDragDatasetHead/getAllChartData endpoint; an attacker then manipulates the 'params' argument to inject SQL. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required against such an instance. Limiting factors: the attack surface is confined to deployments that have the JimuBI BI/drag-dashboard feature present and the specific endpoint reachable, and it is tied to the 3.9.5 build; there is no indicated patch, so exposure is bounded by network reachability of the endpoint rather than by any configuration toggle described in the sources.

The signals converge on a moderate, not critical, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully remote, low-complexity, unauthenticated attack with no user interaction - the most exposed possible access profile - which is why the base concern is real. However, the impact metrics are uniformly Low (VC:L/VI:L/VA:L, SC/SI/SA:N), yielding a score of 6.9 (Medium) rather than critical, indicating the vendor source (VulDB) assessed limited confidentiality, integrity and availability consequences rather than full database compromise. Exploit maturity is E:P (Proof-of-Concept), and the disclosure states a public exploit has been released, which lowers the practical barrier to attack. Countervailing signals keep this below emergency status: it is NOT listed in CISA KEV (no confirmed active exploitation), the vuln.today decision label is 'this_month' rather than act_now or emergency, and no EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified. The most important risk driver beyond the numbers is that the vendor was contacted and did not respond, so no patch is indicated - meaning exposure persists indefinitely for deployed instances. Net: a genuine, remotely reachable unauthenticated SQL injection worth remediating this cycle, but with vendor-assessed partial impact and no evidence of mass exploitation; EPSS is missing and should be checked to refine urgency.

A remote attacker with no credentials sends a crafted HTTP request to the /jeecg-boot/drag/onlDragDatasetHead/getAllChartData endpoint of the JimuBI component, injecting malicious SQL through the 'params' argument. Because the input is used unsafely in a database query (CWE-89), the attacker can read or tamper with backend data. The disclosure states a public exploit has been released, so this attack path is documented, though the released code is not independently verified as a working exploit here.