CVE-2023-40787

CriticalCVSS 9.8

Published: 29/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

19.38%

97th percentile - higher than 97% of all known CVEs

Summary

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.

Risk Assessment

An attacker can exploit this vulnerability to execute unauthorized queries against the database, potentially leading to data disclosure or modification.

Recommendation

It is recommended to upgrade to a newer version of SpringBlade that fixes the handling of parameters in SQL queries.

Original NVD description (English source)

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.