CVE-2026-75334

EUVD-2026-66700
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_resource table through the ReportController.save() interface and directly embedded into Hibernate native queries without any parameterization or filtering.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 51.65%
Common Weakness Enumeration
References
https://github.com/fangtang7/CVE/blob/main/smart-web2/smart-web2%20v1.3.1%20SQL%20Injection.md
https://github.com/fangtang7/CVE/blob/main/smart-web2/smart-web2%20v1.3.1%20SQL%20Injection.md