medium · CVSS v3 6.5

CVE-2026-118871

CVE-2026-118871 is a SQL injection flaw that allows attackers to extract database information while authenticated. It targets applications t

Overview

CVE-2026-118871 is a SQL injection flaw that allows attackers to extract database information while authenticated. It targets applications that improperly sanitize user input. The vulnerability can lead to unauthorized data disclosure.

Description

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

Impact

Confidentiality is compromised as attackers can read sensitive data. Integrity may be affected if malicious queries modify records. Availability is not directly impacted. Defenders should focus on protecting database access and monitoring for suspicious queries.

Remediation

Apply the vendor’s patch or update to the latest version that sanitizes input. Implement parameterized queries or stored procedures. Enable web application firewall rules to block SQL injection patterns. Enforce least privilege for database accounts and monitor logs for anomalous activity.

Risk context

Medium severity (CVSS 6.5). No EPSS data available. Defenders should assess exposure promptly and apply mitigations.

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

sql-injection database authentication internal-threat data-exfiltration

← All CVEs

Related CVEs

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

medium

CVE-2026-120343

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-117531

CVE-2026-117531 affects @fastify/multipart plugin versions 5.3.0 through 10.1.6. A malformed multipart request can cause the plugin to silently destroy the file stream, leaving the request hanging and the connection open. This leads to resource exhaustion and denial of service for applications that use delayed file consumption.

View analysis