PT-2026-30979 · Powerjob · Powerjob

Anch0R · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-5736

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PowerJob versions 5.1.0 through 5.1.2

Description A SQL injection issue exists due to the manipulation of the customQuery argument within an unknown function in the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the detailPlus endpoint. Remote exploitation is possible.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-5736

GHSA-4FP2-3XGG-JG4W

Affected Products

Powerjob

References · 9

• https://github.com/PowerJob/PowerJob/pull/1166 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5736 · Security Note
• https://osv.dev/vulnerability/GHSA-4fp2-3xgg-jg4w · Vendor Advisory
• https://github.com/PowerJob/PowerJob · Note
• https://github.com/PowerJob/PowerJob/issues/1167 · Note
• https://twitter.com/CVEnew/status/2041603155671048410 · Twitter Post
• https://vuldb.com/vuln/355746 · Note
• https://vuldb.com/vuln/355746/cti · Note
• https://vuldb.com/submit/786727 · Note