CVE-2026-7060

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7060", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T01:19:00.706Z", "datePublished": "2026-04-26T20:15:18.830Z", "dateUpdated": "2026-04-27T13:37:52.443Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T20:15:18.830Z"}, "title": "liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "liyupi", "product": "yu-picture", "versions": [{"version": "a053632c41340152bf75b66b3c543d129123d8ec", "status": "affected"}], "modules": ["MyBatis-Plus"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument sortField can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Applying a patch is advised to resolve this issue. The project was informed of the problem early through a pull request but has not reacted yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:TF/RC:C"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T03:24:09.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "anch0r (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359633", "name": "VDB-359633 | liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359633/cti", "name": "VDB-359633 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798612", "name": "Submit #798612 | liyupi yu-picture <= 0.0.1-SNAPSHOT SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/liyupi/yu-picture/issues/4", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/liyupi/yu-picture/pull/3", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/liyupi/yu-picture/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:37:19.666763Z", "id": "CVE-2026-7060", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:37:52.443Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7060", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:37:19.666763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:37:47.878Z"}}], "cna": {"title": "liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "anch0r (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:TF/RC:C"}}], "affected": [{"vendor": "liyupi", "modules": ["MyBatis-Plus"], "product": "yu-picture", "versions": [{"status": "affected", "version": "a053632c41340152bf75b66b3c543d129123d8ec"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T03:24:09.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359633", "name": "VDB-359633 | liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359633/cti", "name": "VDB-359633 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798612", "name": "Submit #798612 | liyupi yu-picture <= 0.0.1-SNAPSHOT SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/liyupi/yu-picture/issues/4", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/liyupi/yu-picture/pull/3", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/liyupi/yu-picture/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument sortField can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Applying a patch is advised to resolve this issue. The project was informed of the problem early through a pull request but has not reacted yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T20:15:18.830Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7060", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:37:52.443Z", "dateReserved": "2026-04-26T01:19:00.706Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T20:15:18.830Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["MyBatis-Plus"], "product": "yu-picture", "vendor": "liyupi", "versions": [{"status": "affected", "version": "a053632c41340152bf75b66b3c543d129123d8ec"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument sortField can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Applying a patch is advised to resolve this issue. The project was informed of the problem early through a pull request but has not reacted yet."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en liyupi yu-picture hasta a053632c41340152bf75b66b3c543d129123d8ec. Esto afecta la funci\u00f3n PageRequest del archivo yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java del componente MyBatis-Plus. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento sortField puede llevar a una inyecci\u00f3n SQL. El ataque puede lanzarse remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto no utiliza versionado. Por esta raz\u00f3n, la informaci\u00f3n sobre las versiones afectadas y no afectadas no est\u00e1 disponible. Se aconseja aplicar un parche para resolver este problema. El proyecto fue informado del problema tempranamente a trav\u00e9s de una pull request, pero a\u00fan no ha reaccionado."}], "id": "CVE-2026-7060", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7060", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:37:19.666763Z", "version": "2.0.3"}}]}, "published": "2026-04-26T22:17:33.620", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/liyupi/yu-picture/"}, {"source": "cna@vuldb.com", "url": "https://github.com/liyupi/yu-picture/issues/4"}, {"source": "cna@vuldb.com", "url": "https://github.com/liyupi/yu-picture/pull/3"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/798612"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359633"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359633/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a053632c41340152bf75b66b3c543d129123d8ec"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "yu-picture", "source": "cna", "vendor": "liyupi"}, "product": "yu-picture", "vendor": "liyupi"}], "analysis": {"en": {"generated_at": "2026-04-28T05:03:52.004520+00:00", "value": {"mitigation_remediation": ["Update yu-picture to the latest commit that includes the fix from pull request #3 once it is merged, or download and apply the patch manually.", "If an update is not immediately possible, disable or remove the sortField parameter from the API, or restrict the request to only allow predefined, safe values for sortField.", "Validate and sanitize all incoming sortField inputs on the server side to ensure only permitted identifiers are used, mitigating further injection attempts."], "summary": {"action": "Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "The affected product is liyupi's yu-picture, an open\u2011source web application without explicit versioning. All releases up to the commit a053632c41340152bf75b66b3c543d129123d8ec are vulnerable, and the project has not released a fixed version yet. Users running any current iteration before the fix are at risk.", "description_and_impact": "The vulnerability is located in the function PageRequest of PictureServiceImpl.java, where the sortField argument is concatenated directly into a SQL query using MyBatis-Plus. This omission of proper input validation allows an attacker to inject arbitrary SQL statements. An attacker can thus read, modify, or delete data in the database, compromising the confidentiality and integrity of the stored information. The flaw provides a classic command injection vector that is exploitable remotely without any authentication, leading to significant risk of data exposure or corruption.", "risk_and_exploitability": "The CVSS v3.1 score is 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting low immediate exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw remotely via crafted HTTP requests that supply a malicious sortField value. Once the injection succeeds, the attacker can execute arbitrary SQL, potentially compromising the entire application database."}}}}, "created": "2026-04-27T19:51:55.442331+00:00", "updated": "2026-04-28T05:15:22.936460+00:00", "vendors": ["liyupi", "liyupi$PRODUCT$yu-picture"]}