CVE-2023-26443

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264455.4Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. M CVE-2023-264465.4The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed CVE-2023-264475.4The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not ge CVE-2023-264485.4Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script CVE-2023-264495.4The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execute CVE-2023-26459.8A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Ma CVE-2023-264505.4The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execut CVE-2023-264517.5Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorizati CVE-2023-264528.8Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this CVE-2023-264538.8Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires a CVE-2023-264548.8Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requ CVE-2023-264557.8RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could