CVE-2026-75330: n/a

The super-diamond-server software, version 1.3.3 and earlier, contains a SQL injection vulnerability in its front-end interface at the path /superdiamond/preview/{projectCode}/{module}/{type}. Specifically, the 'module' parameter is processed via StringUtils.split() and then concatenated directly into an SQL IN clause without parameterization or binding. This improper handling allows an attacker to inject arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the backend database. The vulnerability is tracked as CVE-2026-75330 and is classified under CWE-89 (SQL Injection). No official patch or remediation guidance is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to full compromise of the database, including unauthorized data disclosure, data modification, or denial of service. The CVSS score of 9.8 reflects the critical nature of this vulnerability with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the vulnerable endpoint to untrusted inputs or implement application-layer input validation and parameterized queries as a temporary mitigation.