CVE-2026-7699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7699", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-02T20:13:29.047Z", "datePublished": "2026-05-03T14:00:17.835Z", "dateUpdated": "2026-05-04T13:21:09.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-03T14:00:17.835Z"}, "title": "Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "Dromara", "product": "MaxKey", "versions": [{"version": "3.5.0", "status": "affected"}, {"version": "3.5.1", "status": "affected"}, {"version": "3.5.2", "status": "affected"}, {"version": "3.5.3", "status": "affected"}, {"version": "3.5.4", "status": "affected"}, {"version": "3.5.5", "status": "affected"}, {"version": "3.5.6", "status": "affected"}, {"version": "3.5.7", "status": "affected"}, {"version": "3.5.8", "status": "affected"}, {"version": "3.5.9", "status": "affected"}, {"version": "3.5.10", "status": "affected"}, {"version": "3.5.11", "status": "affected"}, {"version": "3.5.12", "status": "affected"}, {"version": "3.5.13", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-02T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-02T22:18:33.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "xpp39 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/360868", "name": "VDB-360868 | Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360868/cti", "name": "VDB-360868 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/804260", "name": "Submit #804260 | Dromara MaxKey 3.5.13 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injection", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T13:20:54.592099Z", "id": "CVE-2026-7699", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T13:21:09.093Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7699", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T13:20:54.592099Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T13:21:01.157Z"}}], "cna": {"title": "Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "xpp39 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Dromara", "product": "MaxKey", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}, {"status": "affected", "version": "3.5.2"}, {"status": "affected", "version": "3.5.3"}, {"status": "affected", "version": "3.5.4"}, {"status": "affected", "version": "3.5.5"}, {"status": "affected", "version": "3.5.6"}, {"status": "affected", "version": "3.5.7"}, {"status": "affected", "version": "3.5.8"}, {"status": "affected", "version": "3.5.9"}, {"status": "affected", "version": "3.5.10"}, {"status": "affected", "version": "3.5.11"}, {"status": "affected", "version": "3.5.12"}, {"status": "affected", "version": "3.5.13"}]}], "timeline": [{"lang": "en", "time": "2026-05-02T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-02T22:18:33.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/360868", "name": "VDB-360868 | Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360868/cti", "name": "VDB-360868 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/804260", "name": "Submit #804260 | Dromara MaxKey 3.5.13 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injection", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-03T14:00:17.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7699", "state": "PUBLISHED", "dateUpdated": "2026-05-04T13:21:09.093Z", "dateReserved": "2026-05-02T20:13:29.047Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-03T14:00:17.835Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MaxKey", "vendor": "Dromara", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}, {"status": "affected", "version": "3.5.2"}, {"status": "affected", "version": "3.5.3"}, {"status": "affected", "version": "3.5.4"}, {"status": "affected", "version": "3.5.5"}, {"status": "affected", "version": "3.5.6"}, {"status": "affected", "version": "3.5.7"}, {"status": "affected", "version": "3.5.8"}, {"status": "affected", "version": "3.5.9"}, {"status": "affected", "version": "3.5.10"}, {"status": "affected", "version": "3.5.11"}, {"status": "affected", "version": "3.5.12"}, {"status": "affected", "version": "3.5.13"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en Dromara MaxKey hasta 3.5.13. Afectada por este problema es la funci\u00f3n StrUtils.checkSqlInjection del archivo StrUtils.java. Realizar una manipulaci\u00f3n del argumento filtersfields resulta en inyecci\u00f3n SQL. El ataque es posible de ser llevado a cabo de forma remota. El exploit ha sido liberado al p\u00fablico y puede ser usado para ataques. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-7699", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7699", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T13:20:54.592099Z", "version": "2.0.3"}}]}, "published": "2026-05-03T15:15:59.483", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injection"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/804260"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360868"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360868/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.13"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MaxKey", "source": "cna", "vendor": "Dromara"}, "product": "maxkey", "vendor": "dromara"}], "created": "2026-05-03T15:30:24.105746+00:00", "updated": "2026-05-03T17:00:12.959066+00:00", "vendors": ["dromara", "dromara$PRODUCT$maxkey"]}