Which versions of Java are affected by EUVD-2026-12220?

Organizations using CodePhiliaX Chat2DB should be aware of moderate risk from CVE-2026-4173, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for EUVD-2026-12220?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12220. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12220?

Within 30 days: Identify affected systems running CodePhiliaX Chat2DB and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Java EUVD-2026-12220

Q: What is the CVSS score of EUVD-2026-12220?

EUVD-2026-12220 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4173 LOW

SQL Injection (CWE-89)

2026-03-15 VulDB

Java SQLi Chat2db

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 10:00 euvd

EUVD-2026-12220

Analysis Generated

Mar 15, 2026 - 10:00 vuln.today

CVE Published

Mar 15, 2026 - 09:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure of the file DMDBManage.java of the component Database Export Handler. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

CodePhiliaX Chat2DB versions up to 0.3.7 contain a SQL injection vulnerability in the Database Export Handler component (DMDBManage.java) affecting multiple export functions. An authenticated attacker with low privileges can remotely exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure attempts.

Technical ContextAI

The vulnerability exists in the Java-based Chat2DB application's database export functionality, specifically in DMDBManage.java. The affected functions (exportTable, exportTableColumnComment, exportView, exportProcedure, exportTriggers, exportTrigger, updateProcedure) fail to properly sanitize user-supplied input before incorporating it into SQL queries, creating a classical SQL injection vector (CWE-89). Chat2DB is a database management and query tool that handles database connectivity and export operations; the flaw lies in inadequate parameterized query implementation or input validation in the export handler component. The CPE identifier cpe:2.3:a:codephiliax:chat2db:*:*:*:*:*:*:*:* indicates all versions through 0.3.7 are affected across all configurations.

RemediationAI

Immediate mitigation: (1) Upgrade to Chat2DB version >0.3.7 if available (vendor response status unknown; check official GitHub repository for releases beyond 0.3.7); (2) If patched version unavailable, implement network access controls restricting Chat2DB to trusted users/networks only, reducing authenticated attack surface; (3) Monitor database audit logs for suspicious SQL patterns or unusual export activity; (4) Apply least-privilege database credentials to Chat2DB service accounts, limiting damage from SQL injection exploitation; (5) If running Chat2DB in a trusted-user-only environment, consider temporary disablement of export functions until patch availability is confirmed. Long-term: Coordinate with CodePhiliaX to obtain patch release; alternatively, migrate to alternative database tools with better security track records if vendor remains unresponsive. References for patch status: https://github.com/AnalogyC0de/public_exp/issues/21 (confirms POC), https://vuldb.com/?id.351080 (primary vulnerability record).