CVE-2026-111718
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
kuafuai aipexbase
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
Text from CVE List
Affected versions 1
- aipexbaseaffected: all versions through 690adb933e72b1ead911badd52caa6d1f71046cdCVE List
References 4
- vulncheck.com/advisories/aipexbase-through-commit-690adb9-sql-injection-via-api-data-invokeAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-injectionExploitvia CVE List
- github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/OrderByBuilder.java#L24-L67Referencevia CVE List
- github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/GroupByBuilder.java#L22-L33Referencevia CVE List