Threats Tagged 'cve-2026-52887'
View all threats tagged with 'cve-2026-52887'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-52887'
Click on any threat for detailed analysis and mitigation recommendations
Plugin notification in app message: NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE (CVE-2026-52887)CVE-2026-52887 0 NocoBase plugin @nocobase/plugin-notification-in-app-message versions prior to 2.0.61 contain an authenticated SQL injection vulnerability in the /api/myInAppChannels:list endpoint. The vulnerability arises from improper handling of the latestMsgReceiveTimestamp filter parameter, allowing injection of arbitrary SQL via Sequelize.literal without escaping or parameter binding. The default configuration permits anonymous signup and assigns a PostgreSQL superuser role to the database user, enabling remote code execution inside the database container via stacked SQL statements. This allows attackers to execute shell commands and exfiltrate data with a single HTTP GET request after signup and authentication. Join the discussion | GCVE Database | 07/31/2026, 19:44:59 UTC Added: 07/31/2026, 21:29:17 UTC |
Showing 1 to 1 of 1 result