A vulnerability has been found in Dromara MaxKey up to 3.5.13 and classified as critical. Affected by this issue is the function
StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection.
This vulnerability is reported as CVE-2026-7699. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
