CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution . The sqlResource.sql parameter, accepted through the ReportController.save() interface, is stored in the t_report_sql_resource table and then directly embedded into Hibernate native queries without any...