The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 27 Aug 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | SQL Injection in Super‑Diamond Server /superdiamond/preview Endpoint | |
| Weaknesses | CWE-89 |
Wed, 26 Aug 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound. | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-08-26T22:09:05.113Z
Reserved: 2026-08-17T00:00:00.000Z
Link: CVE-2026-75330
No data.
Status : Received
Published: 2026-08-26T23:17:18.533
Modified: 2026-08-26T23:17:18.533
Link: CVE-2026-75330
No data.
OpenCVE Enrichment
Updated: 2026-08-27T00:30:14Z
Weaknesses