CVE-2026-94143
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, leading to data leakage, modification, or deletion. Due to the public exploit, the risk is high.
Recommendation
Update drogon to a version newer than 1.9.13 once the vendor releases a fix. Until then, avoid passing untrusted data to the sort argument and consider input validation.
Other vulnerabilities in drogon
See all- CVE-2026-105144Medium
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-94144High
A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS