CVE-2026-63713

CriticalCVSS 9.0/10Last modified Sep 30, 2026

Description

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Sep 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-637187.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via CVE-2026-63727.5Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control SeCVE-2026-637207.5datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to CVE-2026-637229.8ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS cCVE-2026-637257.2sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by sCVE-2026-637278.8Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management APCVE-2026-637286.3Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to rCVE-2026-637296.6The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-afCVE-2026-63736.5Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application FiCVE-2026-637305.0HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to maCVE-2026-637317.7HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arCVE-2026-637329.99router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh ins
CVE-2026-63713: Critical severity, CVSS 9.0 | Vulnix