CVE-2026-62362

MediumCVSS 4.9/10Last modified Oct 28, 2026

Description

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
PBH-BTNPeerBanHelper>= 5.0.0, < 9.3.15

References

Timeline

Published
Oct 16, 2026
Last modified
Oct 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-623635.0ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer CVE-2026-623642.3wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblatCVE-2026-623655.3Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/aCVE-2026-623677.5Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-proviCVE-2026-623688.4Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomCVE-2026-623698.1KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 unCVE-2026-62376.4The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all vCVE-2026-623706.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 untCVE-2026-623718.8KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 unCVE-2026-623747.1SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decCVE-2026-623768.1Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and accounCVE-2026-623774.3libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_fro