CVE-2026-64880
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The application contains an SQL injection vulnerability in report filtering parameters. Unsanitized user input is concatenated directly into SQL queries, enabling blind SQL injection and unauthorized database read access.
Risk Assessment
An attacker can read sensitive data from the database, potentially leading to information leakage.
Recommendation
Use parameterized queries or proper escaping of user input in report filtering parameters.
Other vulnerabilities in Application
See all- CVE-2026-55977Low
Successful exploitation of this vulnerability allows an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful content on the affected screen.
- CVE-2026-49033High
The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.
- CVE-2026-42958High
The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.
- CVE-2026-42953High
The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.
Original NVD description (English source)
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.