Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75334

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

smart-web2 v1.3.1 后端中的报表模块存在任意 SQL 执行漏洞。 参数通过 接口被存储到 表中，并直接嵌入到 Hibernate 原生查询中，未进行任何参数化或过滤处理。

AI Predicted 8.8 Difficulty: Trivial

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a n/a n/a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75334

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_resource table through the ReportController.save() interface and directly embedded into Hibernate native queries without any parameterization or filtering.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2026-75334

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75334

请登录查看更多情报信息。

Proof of Concept for CVE-2026-75334 (1)

Same Patch Batch · n/a · 2026-08-26 · 48 CVEs total

CVE-2025-51679 openRISC OR1200 83ac6b RTL与网表不一致
CVE-2025-61478 Acre SPC5300.000 v3.14.1 SYN报文致拒绝服务
CVE-2026-75333 yx-image-recognition v1.0 路径遍历漏洞
CVE-2026-75330 super-diamond-server 1.3.3 前端接口 SQL注入
CVE-2026-75332 Zyplayer-Doc 1.0.0 存在SSRF漏洞
CVE-2026-75338 Disconf 2.6.36 未认证访问控制缺陷
CVE-2026-75336 Funiture 1.0.0 后台接口SQL注入
CVE-2026-75340 JetLinks 2.11 设备接口SSRF漏洞
CVE-2026-75328 DocSys V2.02.85 downloadDocEx任意文件读取
CVE-2025-51675 openRISC OR1200 DoS：PC更新不准确
CVE-2025-61479 SACRE SPC5300.000 v3.14.1 SPC Connect Pro DoS漏洞
CVE-2026-39275 Cockpit CMS v2.13.5前XSS漏洞
CVE-2026-52103 SimpleX Chat 6.5前Terminal远程代码执行漏洞
CVE-2026-52473 Wgcloud 3.6.4远程命令执行漏洞
CVE-2026-75415 AntFlow V2.0.0 访问控制缺陷
CVE-2026-75413 DocSys V2.02.80任意文件下载漏洞
CVE-2026-75364 Comfast CF-N1-S 2.6.0.1 webmgnt命令注入漏洞
CVE-2026-75411 JeecgBoot 3.9.2 远程命令执行漏洞
CVE-2026-75363 Comfast CF-WR630AX 远程代码执行漏洞
CVE-2026-75414 AntFlow 2.0.0 JUEL表达式未过滤导致命令执行

Showing top 20 of 48 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2026-75334

No comments yet

Leave a comment