rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9 · EPSS 0.00254

CVE-2026-94143

The drogonframework up to version 1.9.13 contains a SQL injection vulnerability in Mapper::orderBy that can be triggered remotely via manipu

Overview

The drogonframework up to version 1.9.13 contains a SQL injection vulnerability in Mapper::orderBy that can be triggered remotely via manipulated sort arguments. This flaw is publicly known and could allow attackers to read, modify, or delete database contents.

Description

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: attackers can read arbitrary data. Integrity: attackers can modify or delete data. Availability: potential for denial of service if database corrupted. Impacted parties: developers and operators of applications built with drogonframework, especially those exposing Mapper::orderBy to user input.

Remediation

Upgrade drogonframework to version 1.9.14 or later where Mapper::orderBy input is sanitized. If upgrade is not possible, validate or whitelist sort parameters before passing to Mapper::orderBy, use parameterized queries or escape inputs, and monitor database logs for suspicious queries.

Risk context

Severity is high (CVSS 7.3) but EPSS is low (0.00254), indicating a low probability of exploitation yet still requires timely patching. Defenders should prioritize patching within the next 30 days.

Affected products

  • drogonframework 1.9.13
  • drogonframework 1.9.x

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
0.00254

SQL Injection drogonframework ORM Remote High Severity Patch Database

← All CVEs

Related CVEs

high

CVE-2026-94144

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-94139

A command injection flaw exists in the Cookie Handler of Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 via the /send_order.cgi?parameter=loginout endpoint. Attackers can remotely inject OS commands by manipulating the session_id parameter. The vulnerability is publicly exploitable and the vendor has not released a fix.

View analysis

high

CVE-2026-94184

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.

View analysis

high

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

View analysis