CVE-2026-7699

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection

State: Published
Severity: 5.3 Medium
Published: May 3, 2026
Updated: May 4, 2026
Reserved: May 2, 2026

Description

A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
MaxKeyDromara	3.5.0Affected 3.5.1Affected 3.5.2Affected 3.5.3Affected 3.5.4Affected 3.5.5Affected 3.5.6Affected 3.5.7Affected 3.5.8Affected 3.5.9Affected 3.5.10Affected 3.5.11Affected 3.5.12Affected 3.5.13Affected

References

VDB-360868 | Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injectionvdb-entrytechnical-description
VDB-360868 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #804260 | Dromara MaxKey 3.5.13 SQL Injectionthird-party-advisory
https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injectionexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.