CVE-2026-114358

CriticalCVSS 9.3/10Last modified Oct 29, 2026

Description

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1143597.0Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or com CVE-2026-114364.3A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mage_ai/frontend/components/Sessions CVE-2026-1143615.6A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Id CVE-2026-1143626.3A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets T CVE-2026-1143649.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an CVE-2026-1143662.3An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.CVE-2026-1143692.7Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module CVE-2026-114377.3A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the co CVE-2026-1143703.7A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files fro CVE-2026-1143719.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-1143725.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1143735.5Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exp