CVE-2026-102109

HighCVSS 7.1/10Last modified Oct 8, 2026

Description

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-102116.3A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/CVE-2026-1021105.9An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition CVE-2026-1021114.9Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set t CVE-2026-1021127.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021137.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021147.2A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-syst CVE-2026-1021159.8Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the ema CVE-2026-1021167.2-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended locati CVE-2026-1021177.2On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a