CVE-2026-96803: SQL Injection in java110 MicroCommunity
CVE-2026-96803 is a medium severity SQL injection vulnerability in java110 MicroCommunity version 2.0. It affects the fallBack API Endpoint, specifically the QueryServiceSMOImpl.fallBack function in BusinessApi.java. The vulnerability allows remote attackers to manipulate the fallBackSql argument, leading to SQL injection. Exploit code is publicly available. The project has been informed but has not yet responded or issued a fix.
AI Analysis
Technical Summary
This vulnerability exists in java110 MicroCommunity up to version 2.0 in the fallBack API Endpoint. The function QueryServiceSMOImpl.fallBack in BusinessApi.java improperly handles the fallBackSql argument, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no vendor response or patch has been published.
Potential Impact
Successful exploitation can lead to unauthorized SQL command execution on the affected system, potentially compromising data confidentiality, integrity, and availability to a limited extent. The attack can be launched remotely without authentication or user interaction. However, the overall impact is rated medium severity based on the CVSS score and vector.
Mitigation Recommendations
No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor advisory for updates. In the meantime, consider restricting access to the vulnerable API endpoint or implementing input validation and parameterized queries as a temporary mitigation.
CVE-2026-96803: SQL Injection in java110 MicroCommunity
Description
CVE-2026-96803 is a medium severity SQL injection vulnerability in java110 MicroCommunity version 2.0. It affects the fallBack API Endpoint, specifically the QueryServiceSMOImpl.fallBack function in BusinessApi.java. The vulnerability allows remote attackers to manipulate the fallBackSql argument, leading to SQL injection. Exploit code is publicly available. The project has been informed but has not yet responded or issued a fix.
CVSS v4.0
Score 6.9medium
Affected software
java110
MicroCommunity
cpe:2.3:a:java110:microcommunity:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in java110 MicroCommunity up to version 2.0 in the fallBack API Endpoint. The function QueryServiceSMOImpl.fallBack in BusinessApi.java improperly handles the fallBackSql argument, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no vendor response or patch has been published.
Potential Impact
Successful exploitation can lead to unauthorized SQL command execution on the affected system, potentially compromising data confidentiality, integrity, and availability to a limited extent. The attack can be launched remotely without authentication or user interaction. However, the overall impact is rated medium severity based on the CVSS score and vector.
Mitigation Recommendations
No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor advisory for updates. In the meantime, consider restricting access to the vulnerable API endpoint or implementing input validation and parameterized queries as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-23T16:25:34.760Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab48378f7a7c54106b23c92
Added to database: 09/24/2026, 01:57:12 UTC
Last enriched: 09/24/2026, 01:57:56 UTC
Last updated: 09/24/2026, 02:27:38 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.