CVE-2026-93484
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. Lack of validation of the ContentSearch parameter (expected to be "AND" or "OR") in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB allows injection of arbitrary SQL commands.
Risk Assessment
An attacker can inject arbitrary SQL commands, leading to data theft, modification, or denial of service. The risk affects organizations using Znuny version 7.3.6 or earlier.
Recommendation
Update Znuny to a version containing the fix that validates the ContentSearch parameter or uses parameterized queries. Until updated, restrict access to the ticket search functionality.
Other vulnerabilities in Znuny
See all- CVE-2026-93483Critical
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.
- CVE-2026-77506Medium
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
- CVE-2026-50592Medium
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (communication log administration view).
- CVE-2026-50591Medium
Cross-Site Scripting (XSS) vulnerability in Znuny LTS before 6.5.21 and Znuny before 7.3.3 via stored user preferences.
Original NVD description (English source)
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS