CVE-2026-52348

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-523497.8Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute aCVE-2026-52355.3A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4AtCVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to executCVE-2026-52365.3A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4AtomCVE-2026-52377.3A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionalitCVE-2026-523706.1A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary JavascrCVE-2026-523716.5A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scanCVE-2026-52387.3A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the fiCVE-2026-523949.1DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.CVE-2026-52404.3A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /admin_sCVE-2026-52419.6A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repositoryCVE-2026-52428.8Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This is
CVE-2026-52348: Critical severity, CVSS 9.8 | Vulnix