CVE-2026-105412
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to gain read access to the Tuleap database.
Risk Assessment
An attacker could read data from the Tuleap database, potentially leading to leakage of sensitive information. The actual risk depends on the database contents and the privileges tied to the vulnerable point.
Recommendation
Update Tuleap Enterprise Edition to a version where the vulnerability is fixed. Until then, restrict access to the affected component and monitor for unusual database queries.
Other vulnerabilities in Tuleap Enterprise Edition
See all- CVE-2026-105411High
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.
- CVE-2026-105410High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-105409High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-105408High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-84285High
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
- CVE-2026-19851High
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
- CVE-2026-14165High
The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.
Original NVD description (English source)
An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS