A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. (CVE-2026-108569)

CVE-2026-108569 describes a SQL injection vulnerability in Furion .NET Framework versions up to 4.9.9.92. The vulnerability is located in the String.Replace function of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. Manipulating the argument 'Name' can lead to SQL injection, enabling remote exploitation. Public exploit code exists, but the vendor has not issued any response or patch. The CVSS 3.1 base score is 6.3, reflecting a low severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized SQL injection attacks, potentially allowing attackers to read or modify database contents remotely. The impact affects confidentiality, integrity, and availability of the affected system. However, the CVSS score and severity are rated low, indicating limited impact or exploitability conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying additional SQL injection mitigations such as input validation or using web application firewalls until an official fix is released.