CVE-2026-28156

HighCVSS 8.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.

Risk of data leakage, modification or deletion of data, and in extreme cases server compromise.

Update the Do Lasso plugin to the latest version and restrict user account privileges.

Original NVD description (English source)

Subscriber SQL Injection in Do Lasso <= 358 versions.