CVE-2026-75330

CriticalCVSS 9.8

Published: 26/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} in super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

Risk Assessment

An attacker can exploit SQL injection to manipulate queries, potentially leading to unauthorized data access or modification.

Recommendation

It is recommended to use parameterized queries or prepared statements for the module parameter and validate input data.

Original NVD description (English source)

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.