CVE-2025-15439
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Daptin 0.10.3, the goqu.L function in server/resource/resource_aggregate.go of the Aggregate API component is vulnerable to SQL injection via manipulation of the column/group/order arguments. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, risking data leakage, modification, or deletion from the database.
Recommendation
Restrict access to the Aggregate API, enforce validation of column/group/order parameters, and consider updating or patching Daptin since the vendor did not respond to the disclosure.
Other vulnerabilities in Daptin
See all- CVE-2026-41422High
Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.
- CVE-2026-72575Critical
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.
Original NVD description (English source)
A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the component Aggregate API. The manipulation of the argument column/group/order leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS