CVE-2026-102491: SQL Injection in mahonelau kykms
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability in mahonelau kykms up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7 allows remote attackers to perform SQL injection via the 'column' argument in the QueryGenerator.doMultiFieldsOrder function. The flaw exists in the SqlInjectionUtil component's QueryGenerator.java file. The product's rolling release approach means no discrete version numbers are given for affected or fixed releases. Public exploit code exists, increasing the risk of exploitation. The vendor has not provided any advisory or patch information.
Potential Impact
Successful exploitation can lead to unauthorized SQL command execution, potentially compromising the confidentiality and integrity of the backend database. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 score of 6.9 reflects a medium severity with low attack complexity and no privileges required. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates. Until a fix is released, consider applying application-level input validation or filtering on the 'column' parameter to mitigate injection risk.
CVE-2026-102491: SQL Injection in mahonelau kykms
Description
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 6.9medium
Affected software
mahonelau
kykms
cpe:2.3:a:mahonelau:kykms:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in mahonelau kykms up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7 allows remote attackers to perform SQL injection via the 'column' argument in the QueryGenerator.doMultiFieldsOrder function. The flaw exists in the SqlInjectionUtil component's QueryGenerator.java file. The product's rolling release approach means no discrete version numbers are given for affected or fixed releases. Public exploit code exists, increasing the risk of exploitation. The vendor has not provided any advisory or patch information.
Potential Impact
Successful exploitation can lead to unauthorized SQL command execution, potentially compromising the confidentiality and integrity of the backend database. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 score of 6.9 reflects a medium severity with low attack complexity and no privileges required. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates. Until a fix is released, consider applying application-level input validation or filtering on the 'column' parameter to mitigate injection risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-29T09:57:33.859Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abbeaade94738e05c4dd19f
Added to database: 09/29/2026, 16:43:25 UTC
Last enriched: 09/29/2026, 16:57:09 UTC
Last updated: 09/29/2026, 18:20:12 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.