Threats tagged 'ghsa-pwqg-q8pg-pp6r'

CVE-2026-44349 is a SQL injection vulnerability in the Daptin API's fuzzy search functionality. The vulnerability arises because the user-supplied column names in fuzzy search queries are directly interpolated into raw SQL without proper whitelist validation. This allows any authenticated user, including self-registered non-admin users, to perform unauthorized database reads. The flaw affects multiple database backends including SQLite, PostgreSQL, MySQL, and MSSQL, with confirmed dynamic exploitation on SQLite and PostgreSQL. A fix is available in Daptin version 0.11.5 that adds proper column name validation.