CVE-2026-9305
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A SQL Injection vulnerability has been identified in QuantumNous new-api up to version 0.12.1 in the SearchUserTopUps/SearchAllTopUps function in file model/topup.go of the self Endpoint component. The attack can be initiated remotely, and the exploit has been made public. The vendor did not respond.
Risk Assessment
Risk of user and transaction data leakage, as well as potential data manipulation in the API system.
Recommendation
Immediately validate input in SearchUserTopUps/SearchAllTopUps functions and use parameterized queries. Consider replacing the component if the vendor is unresponsive.
Other vulnerabilities in QuantumNous new-api
Original NVD description (English source)
A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/topup.go of the component self Endpoint. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS