CVE-2026-52470

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

SQL injection vulnerability in Crocus v.1.3.44. A remote attacker can escalate privileges via the RecordStateMapper.xml file.

An attacker can gain unauthorized access to the database and escalate privileges, potentially leading to full compromise of the Crocus system.

Update Crocus to a version that fixes the SQL injection vulnerability in the RecordStateMapper.xml file.

Original NVD description (English source)

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file