CVE-2026-5736
Published: 07 April 2026
Summary
CVE-2026-5736 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5736 is a SQL injection vulnerability affecting PowerJob versions 5.1.0, 5.1.1, and 5.1.2. The flaw exists in an unknown function within the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java, specifically the detailPlus endpoint component. Manipulation of the customQuery argument leads to SQL injection, as classified under CWE-74 and CWE-89. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-04-07.
Remote attackers can exploit this vulnerability over the network with low complexity and no required privileges or user interaction. Successful exploitation enables limited impacts on confidentiality, integrity, and availability through SQL injection.
The PowerJob project was informed early via GitHub issue #1167 but has not responded as of the latest reports. A related pull request #1166 exists in the repository at https://github.com/PowerJob/PowerJob/. Further details are available on VulDB at https://vuldb.com/vuln/355746 and the submission page https://vuldb.com/submit/786727. No official patches or mitigations have been confirmed from the maintainers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19893
Vulnerability details
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project…
more
was informed of the problem early through an issue report but has not responded yet.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a web controller endpoint (detailPlus with customQuery) allows remote unauthenticated exploitation of a public-facing application for initial access and limited data impacts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating the customQuery argument in the PowerJob detailPlus endpoint.
Requires timely flaw remediation to patch the SQL injection vulnerability in affected PowerJob versions.
Boundary protection with web application firewall blocks SQL injection payloads targeting the remote detailPlus endpoint.