Threat database

Jellystat versions prior to 1.1.10 contain a critical SQL injection vulnerability in multiple API endpoints that accept unsanitized input. Authenticated users can exploit this flaw to execute arbitrary SQL commands, including reading sensitive tables such as app_config, which holds admin credentials and API keys. The vulnerability allows stacked queries, enabling remote code execution on the PostgreSQL host with the privileges of a superuser role as configured by the default docker-compose setup. Version 1.1.10 includes a fix for this issue.