https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 24 Sep 2026 09:36:33 +0000 https://vulnerability.circl.lu/sighting/44269d05-6edf-4ff7-8a6e-a41852c30bc1/export {"uuid": "44269d05-6edf-4ff7-8a6e-a41852c30bc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61685", "type": "seen", "source": "https://gist.github.com/alon710/3dbddf53ea2ffbacecef5870088d9a78", "content": "# CVE-2026-61685: CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61685\n\n## Summary\nAn unauthenticated remote SQL injection vulnerability exists in multiple API list endpoints of ReactPress prior to version 3.7.0. The vulnerability stems from unsafe construction of TypeORM QueryBuilder conditions, where untrusted HTTP query parameter keys are interpolated directly into SQL statements as identifiers without sanitization or validation.\n\n## TL;DR\nUnauthenticated remote SQL injection in ReactPress prior to v3.7.0 allows attackers to execute arbitrary SQL queries by tailoring query parameter keys in API requests, exposing sensitive database contents.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00535 (44.13% percentile)\n- **Impact**: Confidentiality: High, Integrity: None, Availability: None\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ReactPress (fecommunity/reactpress) backend server installations running versions prior to 3.7.0\n- **ReactPress**: < 3.7.0 (Fixed in: `3.7.0`)\n\n## Mitigation\n\n- Upgrade to ReactPress v3.7.0 or higher to apply strict whitelist validation.\n- Deploy Web Application Firewall (WAF) rules to inspect and sanitize HTTP query parameter keys.\n- Manually implement query key whitelist checking in the database service layer as a temporary workaround.\n\n**Remediation Steps:**\n1. Verify the current installed version of ReactPress.\n2. Retrieve version 3.7.0 from the official release repository using git fetch.\n3. Checkout tag v3.7.0 and install dependencies using npm install.\n4. Rebuild and restart the NestJS server application.\n5. Verify that SQL injection payloads in query parameter keys are rejected with empty results or HTTP errors.\n\n## References\n\n- [GHSA-wmw4-mw6x-6vfm: SQL Injection in ReactPress](https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm)\n- [ReactPress Fix Commit 78ecb70af1c021455c05fdcbe137212c70e310d6](https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6)\n- [ReactPress Release v3.7.0](https://github.com/fecommunity/reactpress/releases/tag/v3.7.0)\n- [NVD - CVE-2026-61685 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-61685)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61685) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T23:31:11.721219Z"} {"uuid": "44269d05-6edf-4ff7-8a6e-a41852c30bc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61685", "type": "seen", "source": "https://gist.github.com/alon710/3dbddf53ea2ffbacecef5870088d9a78", "content": "# CVE-2026-61685: CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61685\n\n## Summary\nAn unauthenticated remote SQL injection vulnerability exists in multiple API list endpoints of ReactPress prior to version 3.7.0. The vulnerability stems from unsafe construction of TypeORM QueryBuilder conditions, where untrusted HTTP query parameter keys are interpolated directly into SQL statements as identifiers without sanitization or validation.\n\n## TL;DR\nUnauthenticated remote SQL injection in ReactPress prior to v3.7.0 allows attackers to execute arbitrary SQL queries by tailoring query parameter keys in API requests, exposing sensitive database contents.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00535 (44.13% percentile)\n- **Impact**: Confidentiality: High, Integrity: None, Availability: None\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ReactPress (fecommunity/reactpress) backend server installations running versions prior to 3.7.0\n- **ReactPress**: < 3.7.0 (Fixed in: `3.7.0`)\n\n## Mitigation\n\n- Upgrade to ReactPress v3.7.0 or higher to apply strict whitelist validation.\n- Deploy Web Application Firewall (WAF) rules to inspect and sanitize HTTP query parameter keys.\n- Manually implement query key whitelist checking in the database service layer as a temporary workaround.\n\n**Remediation Steps:**\n1. Verify the current installed version of ReactPress.\n2. Retrieve version 3.7.0 from the official release repository using git fetch.\n3. Checkout tag v3.7.0 and install dependencies using npm install.\n4. Rebuild and restart the NestJS server application.\n5. Verify that SQL injection payloads in query parameter keys are rejected with empty results or HTTP errors.\n\n## References\n\n- [GHSA-wmw4-mw6x-6vfm: SQL Injection in ReactPress](https://github.com/fecommunity/reactpress/security/advisories/GHSA-wmw4-mw6x-6vfm)\n- [ReactPress Fix Commit 78ecb70af1c021455c05fdcbe137212c70e310d6](https://github.com/fecommunity/reactpress/commit/78ecb70af1c021455c05fdcbe137212c70e310d6)\n- [ReactPress Release v3.7.0](https://github.com/fecommunity/reactpress/releases/tag/v3.7.0)\n- [NVD - CVE-2026-61685 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-61685)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61685) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T23:31:11.721219Z"} https://vulnerability.circl.lu/sighting/44269d05-6edf-4ff7-8a6e-a41852c30bc1/export Wed, 23 Sep 2026 23:31:11 +0000