CVE-2026-90511 describes a SQL injection vulnerability in GongShengyue OnlineBooks affecting the listSplit interface in the BooksServlet.java source file. The flaw is due to improper sanitization of the 'column' argument, which can be manipulated remotely to execute arbitrary SQL commands. The product's rolling release model prevents precise version identification of affected or patched releases. The vulnerability has a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Public exploit code exists, but no confirmed exploitation in the wild has been reported.

Successful exploitation can lead to unauthorized SQL command execution, potentially resulting in limited confidentiality, integrity, and availability impacts. The CVSS vector indicates the attack requires low complexity, low privileges, no user interaction, and network access. The impact is limited to partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed due to the rolling release system and lack of disclosed fixed versions. Users should consult the vendor's advisory or update to the latest release as the vendor continuously delivers updates. Until then, apply any available security controls to restrict access to the vulnerable interface and monitor for suspicious activity related to SQL injection attempts.