CVE-2026-40836

High

Published: 27/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The inmessage model has a SQL Injection vulnerability that can be exploited by a low privileged attacker. Due to improper neutralization of special elements in a SQL DELETE command, the attacker can read the entire database and delete entries in a non-critical table.

Risk Assessment

This vulnerability can lead to a total loss of data confidentiality and some loss of integrity. Organizations may face serious consequences related to data security.

Recommendation

It is recommended to implement appropriate safeguards, such as input validation and using parameters in SQL queries, to minimize the risk of SQL Injection attacks.

Original NVD description (English source)

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.