Threats tagged 'ghsa-6ghx-3h5v-82fp'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.0	CVE-2026-125381DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role Medium6.02026-11-10GCVE DatabaseCVE-2026-125381 DataRoom versions up to 3.0.0 contain an SQL injection vulnerability in the MyBatisService.generateSql function. This flaw allows users with sharer-role privileges to inject SQL commands by supplying specially crafted dataset parameters. Exploitation occurs via the /dataRoom/dataset/run endpoint by sending manipulated inputParam values that exploit unquoted string parameters or MySQL backslash escapes to execute arbitrary SQL queries against the database. Report on CVE-2026-125381 Vulnerability CWE-89 #ghsa-6ghx-3h5v-82fp	GCVE Database	2026-11-10

Page 1 of 1