CVEvulnerability

CVE-2026-71298

6.4 MEDIUM Published 2026-10-05 Modified 2026-10-06 Official page ↗
Status
Awaiting Analysis
Published
2026-10-05
Last modified
2026-10-06
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-89

Description

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References