← Database

CVE-2026-75330

CRITICAL CVSS: 9.8 Published: 2026-08-26 Modified: 2026-08-31

Description

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

Affected Platforms

Unknown

Weakness Type

CWE-89

References