Home

Description

A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the component JSON Object Handler. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor confirms (translated from Chinese): "It should have been fixed; a batch of issues were recently resolved."

PUBLISHED Reserved 2026-05-07 | Published 2026-05-07 | Updated 2026-05-07 | Assigner VulDB




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

SQL Injection

Injection

Timeline

2026-05-07:Advisory disclosed
2026-05-07:VulDB entry created
2026-05-07:VulDB entry last update

Credits

JD Security SHENYI Team (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/361902 (VDB-361902 | JeecgBoot JSON Object loadTreeData sql injection) vdb-entry technical-description

vuldb.com/vuln/361902/cti (VDB-361902 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/808186 (Submit #808186 | https://github.com/jeecgboot/JeecgBoot <=3.91 SQL Injection) third-party-advisory

github.com/jeecgboot/JeecgBoot/issues/9571 exploit issue-tracking

github.com/jeecgboot/JeecgBoot/ product

cve.org (CVE-2026-8114)

nvd.nist.gov (CVE-2026-8114)

Download JSON