CVE-2026-5372

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0). This is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H (6.4 Medium). This issue was fixed in version 4.0.260123.1 of the runZero Platform.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-537205.1pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blo CVE-2026-537218.2Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a rou CVE-2026-537225.4Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme CVE-2026-537235.8Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, ser CVE-2026-537242.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-a CVE-2026-537255.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version CVE-2026-537266.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-a CVE-2026-537278.6css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_CVE-2026-537287.1Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback CVE-2026-537298.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/downlo CVE-2026-53738.4An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-CVE-2026-537308.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the man