CVE-2026-111718Published
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111718 · Microsoft / collected KEV context
cve-program · CVE-2026-111718
- https://hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-injection
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/OrderByBuilder.java#L24-L67
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/GroupByBuilder.java#L22-L33
- https://www.vulncheck.com/advisories/aipexbase-through-commit-690adb9-sql-injection-via-api-data-invoke
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.