Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90511

GongShengyue OnlineBooks listSplit BooksServlet.java sql injection

CVSS 4.0 5.3 MEDIUMCVSS 3.1 6.3 MEDIUMCVSS 3.0 6.3 MEDIUMCVSS 2.0 6.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90511

Published

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90511

Published

OnlineBooks

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GongShengyue",
                    "product": "OnlineBooks",
                    "versions": [
                        {
                            "version": "dfc5eacc08d3b0396c266049548618f6fb9587ea",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gongshengyue:onlinebooks:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "listSplit Interface"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON