CVE-2026-108569
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92, impacting the String.Replace function in framework/Furion/Templates/Extensions/StringRenderExtensions.cs. Manipulation of the Name argument leads to SQL injection. Remote exploitation is possible and the exploit is publicly available.
Risk Assessment
The vulnerability enables remote SQL injection, potentially leading to data leakage, modification, or deletion from the database. The vendor's lack of response increases the risk of exploitation.
Recommendation
Immediately restrict access to the vulnerable function and implement input validation and WAF rules. Monitor for a patch and consider temporarily disabling the function.
Other vulnerabilities in Furion .NET Framework
Original NVD description (English source)
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS