CVE-2026-7699

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection

Medium5.3EPSS 0.20%

Published: 3 May 2026
Updated: 4 May 2026
Reserved: 2 May 2026
Assigned by: VulDB

Description

A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java. Performing a manipulation of the argument filtersfields results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS scores of CVE-2026-7699, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	3.0	Medium6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
NVDNVD · Deferred	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.20% · top 91% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

Dromara · MaxKey
- affected 3.5.0
- affected 3.5.1
- affected 3.5.2
- affected 3.5.3
- affected 3.5.4
- affected 3.5.5
- affected 3.5.6
- affected 3.5.7
- affected 3.5.8
- affected 3.5.9
- affected 3.5.10
- affected 3.5.11
- affected 3.5.12
- affected 3.5.13

References (4)

VDB-360868 | Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection (opens in a new tab)vdb-entrytechnical-description
VDB-360868 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
Submit #804260 | Dromara MaxKey 3.5.13 SQL Injection (opens in a new tab)third-party-advisory
https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injection (opens in a new tab)exploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-7699](https://trackcve.app/badge/CVE-2026-7699.svg)](https://trackcve.app/cve/CVE-2026-7699)

Record last updated 4 May 2026, 13:21 UTC.