CVE Catalog
CVE-2026-72565
CriticalCVSS 9.8Summary
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
Risk Assessment
The risk includes unauthorized access to sensitive database data, potentially leading to information disclosure and privacy breaches.
Recommendation
Update APIJSON to the latest patched version and implement additional security measures such as query parameterization.
Original NVD description (English source)
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.