CVE-2026-75334: n/a

CVE-2026-75334 describes an SQL injection vulnerability in smart-web2 v1.3.1's backend report module. The sqlResource.sql parameter is saved in the t_report_sql_resource table via the ReportController.save() interface and is directly used in Hibernate native queries without any sanitization or parameterization. This lack of input validation enables attackers to execute arbitrary SQL commands against the database, potentially compromising confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL commands remotely, leading to full compromise of the database, including data disclosure, modification, and deletion. The CVSS score of 9.8 reflects the critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ReportController.save() interface and validate or sanitize inputs to prevent injection. Avoid using unparameterized queries and implement proper input validation in the affected module.