CVE-2026-94144
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, leading to data leakage, modification, or deletion. Due to the public exploit, the risk is high.
Recommendation
Update drogon to a version newer than 1.9.13 once the vendor releases a fix. Until then, avoid passing untrusted data to the filter argument and consider input validation.
Other vulnerabilities in drogon
See all- CVE-2026-105144Medium
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-94143High
A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS