Critical severity9.8NVD Advisory· Published Aug 10, 2026· Updated Aug 10, 2026

CVE-2026-72565

Description

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

Affected products

Tencent/APIJSONllm-fuzzy
Range: <=8.1.8

Patches

Vulnerability mechanics

References

github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.javanvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000