CVE-2026-111718AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
Updated under an hour ago ()
Does this affect you?
It affects kuafuai aipexbase. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-89
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
kuafuai aipexbase kuafuai:aipexbase (from the name) | through 690adb933e72b1ead911badd52caa6d1f71046cd | CNA record |
References
- https://hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-injectionthird-party-advisory
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/OrderByBuilder.java#L24-L67technical-description
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/GroupByBuilder.java#L22-L33technical-description
- https://www.vulncheck.com/advisories/aipexbase-through-commit-690adb9-sql-injection-via-api-data-invokethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.