CVE-2026-39574

Published Jun 16, 2026

Last updated 19 days ago

CVSS critical 9.3
SQL injection

Overview

Description
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
Source
audit@patchstack.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.3
Impact score
4.7
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Severity
CRITICAL

Weaknesses

audit@patchstack.com
CWE-89

Social media

Hype score
Not currently trending

Related CVEs

  1. An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.•CVE-2026-40848
  2. An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.•CVE-2026-40845
  3. An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.•CVE-2026-40818
  4. Drupal Core SQL Injection Vulnerability•CVE-2026-9082
  5. SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.•CVE-2026-44862

References

Sources include official advisories and independent security research.