CVE-2026-102109
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.
Risk Assessment
Risk of unauthorized access to or modification of database data by an authenticated user, potentially leading to data confidentiality and integrity breaches.
Recommendation
Apply vendor security patches for Kiteworks. If the optional feature is not used, consider disabling it. Restrict access to Secure Data Forms functionality.
Other vulnerabilities in Kiteworks Secure Data Forms
Original NVD description (English source)
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS