CVE-2026-1746 | JeecgBoot 3.9.0 Online Report API loadDictItemByKeyword keyword sql injection

A vulnerability was found in JeecgBoot 3.9.0 and classified as critical. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection.

This vulnerability is documented as CVE-2026-1746. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.