CVE-2026-57308

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-573099.3A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URCVE-2026-57319.8Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. SCVE-2026-573106.3Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain passwordCVE-2026-573115.3Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to RCVE-2026-573127.1Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-573136.5Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.CVE-2026-573147.1Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.CVE-2026-573158.5Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-573166.5Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-573177.1Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.CVE-2026-573186.5Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.CVE-2026-573197.1Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.