CVE-2026-40813

HighCVSS 7.5

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

CVE-2026-40813 describes an unauthenticated remote SQL Injection vulnerability in the tagid parameter of the getLiveValues function. Improper neutralization of special elements in a SQL SELECT command can lead to a total loss of confidentiality.

Risk Assessment

An attacker could gain access to sensitive data, posing a significant threat to the organization's security.

Recommendation

It is recommended to implement proper input filtering and validation to prevent SQL Injection attacks.

Other vulnerabilities in getLiveValues function

CVE-2026-40812High
There is a remote SQL Injection vulnerability in the getLiveValues function that allows unauthorized access to data. An attacker can exploit this flaw, leading to a total loss of data confidentiality.

Original NVD description (English source)

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS