JeecgBoot EUVD-2026-119777

Exploitation requires an authenticated low-privilege account (CVSS PR:L) able to reach the Table Dictionary API endpoint /jeecg-boot/jmreport/form/getTableDictList, which is part of the JimuReport (JimuFormApiService.getTableDictList) functionality of JeecgBoot 3.9.5; the attacker then manipulates the searchSql argument to inject SQL. No user interaction is needed (UI:N) and the attack is remote (AV:N). The principal limiting factor is the authentication requirement - an attacker must first hold valid low-privilege credentials or a session on the target instance; exposure is further bounded to deployments running the affected 3.9.5 version with the JimuReport form/dictionary feature reachable.

Signals are mostly low and internally consistent, pointing to a genuine but low-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw, but it requires authentication (PR:L) and the vendor-assigned impacts are all Low (VC:L/VI:L/VA:L), yielding a base score of only 2.1. The SSVC-style priority label in the input is 'monitor', not act_now or emergency, and the exploit maturity is Proof-of-Concept (E:P). There is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation. One tension worth flagging: the weakness is SQL injection (CWE-74) via a raw SQL fragment parameter (searchSql), a class that often enables broad database read/modify, yet the reported confidentiality/integrity/availability impacts are only Low - this may understate real impact and should be verified against the actual query context. Note also that the only sources are vuldb records; no independent vendor advisory or NVD enrichment is present, and the vendor did not respond to disclosure.

An authenticated low-privilege user of a JeecgBoot 3.9.5 instance sends a request to the Table Dictionary API endpoint (/jeecg-boot/jmreport/form/getTableDictList) with a crafted searchSql value, injecting attacker-controlled SQL into the backend query. Because the attack is network-reachable with low complexity, the actor can read or tamper with database-accessible data within the privileges of the application's DB connection. A public proof-of-concept reference is cited, lowering the effort required to reproduce it.