CVE-2026-75132

MediumCVSS 6.5

Published: 31/08/2026(UTC)Updated: 08/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions, bypass host scope restrictions, and read information from other rows or tables.

Risk Assessment

The attack could allow unauthorized access to database data, including information about other hosts, posing a serious confidentiality breach.

Recommendation

Update WAPT Server to a patched version immediately and restrict user privileges to the minimum necessary.

Other vulnerabilities in WAPT Server

CVE-2026-33591Critical
In Wapt Server before version 2.6.1.17813, a remote unauthenticated attacker can bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account.

Original NVD description (English source)

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.