CVE-2026-52348
A critical SQL injection vulnerability exists in cool-admin-java 8.0.0, allowing attackers to execute arbitrary SQL via the order() method in CrudOption.java. The flaw could let attackers read, modify, or delete data in the database.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
cool-admin-java version 8.0.0, typically used by developers or administrators running the web application.
Real-world impact
An attacker could run arbitrary SQL commands, potentially exposing sensitive data, altering records, or deleting data.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact (complete confidentiality, integrity, and availability loss) and the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.