Miembros de
Boletines de Vulnerabilidades |
CVE-2026-125381 |
|
| Software afectado | MYSQL |
| DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-125381 | |
