CVE-2026-7672

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/boot/system/controller/UserController.java of the component Users Endpoint. Such manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 3, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-767204.3A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.CVE-2026-767219.8Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacCVE-2026-767229.8Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticaCVE-2026-767239.6Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacenCVE-2026-767249.6A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent aCVE-2026-767259.6A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent aCVE-2026-767268.1An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to byCVE-2026-767277.2Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attaCVE-2026-767287.2A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to coCVE-2026-767296.6A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high prCVE-2026-76734.7A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/javCVE-2026-767306.5An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adja
CVE-2026-7672: Medium severity, CVSS 6.3 | Vulnix