mediumCVSS 7.3Vulnerability
CVE-2026-5736
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Properties
- summary
- PowerJob vulnerable to SQL injection
- severity
- medium
- epss_score
- 0.00269
- cvss_score
- 7.3
- ghsa_published
- 2026-04-07T21:32:39Z
- source_url
- https://github.com/advisories/GHSA-4fp2-3xgg-jg4w
- ghsa_updated
- 2026-04-08T19:38:12Z
- ghsa_id
- GHSA-4fp2-3xgg-jg4w
- cve_id
- CVE-2026-5736
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- is_ghsa_only
- false
- epss_percentile
- 0.19181
Related Entities (6)
VULNERABLE_TO (1)
←[Software]maven/tech.powerjob:powerjob-server-starter
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (2)
→[Weakness]Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
→[Weakness]Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
AFFECTS (1)
→[Software]maven/tech.powerjob:powerjob-server-starter
Explore deeper with Ninja Signal's threat intelligence graph