Log in Start free

Vulnerability · Published Apr 7, 2026 · Assigned by VulDB

CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injection

High 7.3

In plain English

A high-severity SQL injection in PowerJob. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Maventech.powerjob:powerjob-server-starterno fix listedGHSA-4fp2-3xgg-jg4w

Affected products (as reported)

VendorProductVersions
n/a PowerJob 5.1.05.1.15.1.2

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References