CVE-2026-19354
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A SQL injection vulnerability was found in OPMS (lock-upme) up to a specific commit, affecting an unknown function in the file controllers/messages/message.go of the IN Clause Handler component. Manipulating the ids argument allows remote attack. The product uses a rolling release strategy, so specific versions are not provided.
Risk Assessment
SQL injection may allow an attacker to gain unauthorized access to the database or modify it, potentially leading to data integrity breaches. Lack of specific versions complicates patch management.
Recommendation
It is recommended to follow the project repository and update to the latest commit that includes the fix. Also validate input data in the application.
Original NVD description (English source)
A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.