CVE-2026-0242

Published May 13, 2026

Last updated 2 months ago

CVSS medium 6.1
SQL injection

Overview

Description
A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.
Source
psirt@paloaltonetworks.com
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
6.1
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber
Severity
MEDIUM

Weaknesses

psirt@paloaltonetworks.com
CWE-89

Social media

Hype score
Not currently trending

Related CVEs

  1. SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file•CVE-2026-52470
  2. The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.•CVE-2026-11349
  3. WordPress Core SQL Injection Vulnerability•CVE-2026-60137
  4. Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.•CVE-2026-39574
  5. An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.•CVE-2026-40848

References

Sources include official advisories and independent security research.