CVE-2026-75330CWE-89sql-injection

CVE-2026-75330

Critical · published August 27, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-27T03:17Z
References (2)
https://github.com/fangtang7/CVE/blob/main/super-diamond/SQLI-HTTP.md · [email protected]https://github.com/fangtang7/CVE/blob/main/super-diamond/SQLI-HTTP.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection
    cvelistv5