EUVD-2026-96875
GHSA-384j-rrq8-q3g3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit crafted 'Name' argument to template renderer
-
ExploitTrigger SQL injection via String.Replace
-
ExecutionExecute injected query against backend database
-
ImpactExfiltrate or modify limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a low-privilege authenticated session (PR:L) on an application built with the Furion .NET framework (versions up to 4.9.9.92), and requires that the vulnerable template-rendering code path - String.Replace in framework/Furion/Templates/Extensions/StringRenderExtensions.cs - processes attacker-controlled input via the 'Name' argument. Limiting factors: an authenticated account is needed (not fully unauthenticated), the affected product must be deployed and network-reachable, and only versions up to 4.9.9.92 are indicated; no user interaction is required (UI:N). |
| Impact | Signals are modest and partly conflicting. The vendor-supplied CVSS 4.0 base score is 5.3 (MEDIUM) with AV:N/AC:L/PR:L/UI:N and only Low impact on confidentiality, integrity and availability (VC:L/VI:L/VA:L) - unusual for a SQL injection (CWE-89), which typically yields High data-confidentiality impact; this suggests VulDB scored it conservatively, so the real impact may be understated. The E:P temporal metric plus the description ('The exploit is publicly available') confirms publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. SSVC-style reading: exploitation = POC (not active), technical impact = partial, automatable is plausible for SQLi but unconfirmed. Net: this is a real but lower-priority issue - an authenticated (PR:L) remote SQL injection in a niche third-party .NET framework. Key missing data: no EPSS, no independent CVSS, no vendor advisory (vendor did not respond), and the single-sourcing to VulDB limits confidence. Prioritize patching only where Furion is actually deployed and internet-exposed. |
| Exploit ScenarioDerived | An attacker holding a low-privilege authenticated account on an application built with the Furion .NET framework supplies a crafted value in the 'Name' argument that is passed to String.Replace within the template-rendering extension (StringRenderExtensions.cs), injecting SQL that the backend executes. Because public exploit code exists and the vector is network-based with low attack complexity, a motivated attacker could read or tamper with limited database contents. No active in-the-wild exploitation is confirmed - only a proof-of-concept is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
SQL injection in Furion .NET Framework up to 4.9.9.92 allows an authenticated low-privilege attacker to manipulate the 'Name' argument processed by String.Replace in framework/Furion/Templates/Extensions/StringRenderExtensions.cs, potentially altering database queries. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no official patch has been released. Network exploitation requires a valid low-privilege session (CVSS 4.0 score 5.3, E:P); no CISA KEV active exploitation is indicated.
RemediationAI
No vendor-released patch was identified at time of analysis; the vendor did not respond to the disclosure. Until an official fix is available, restrict network access to applications built with Furion so that only trusted, low-privilege authenticated users can reach endpoints that invoke template rendering, and audit those accounts regularly-this reduces the attack surface but does not eliminate the flaw for legitimate users. Enforce strict input validation and sanitization on any data passed to StringRenderExtensions or the Name argument, and avoid rendering templates with untrusted user input; this may require application code changes and could break legitimate dynamic content. Deploy a web application firewall (WAF) with SQL injection signatures tuned to inspect requests that reach Furion template endpoints, accepting potential false positives and performance overhead. Monitor database logs for unexpected SQL patterns originating from the application, and track the VulDB references (https://vuldb.com/vuln/416226 and https://vuldb.com/cve/CVE-2026-108569) for updated guidance or a patched release. Upgrading to a version newer than 4.9.9.92 should be evaluated only after confirming with the maintainer that it addresses this issue, since no fixed version is currently documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-89 (SQL injection) in the Furion .NET framework, specifically in framework/Furion/Templates/Extensions/StringRenderExtensions.cs where the String.Replace method processes a 'Name' argument. Furion is an open-source .NET application framework that includes template-rendering extensions; when untrusted input reaches this rendering path, it can be incorporated into SQL statements without proper sanitization, enabling query manipulation. The CPE cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:* identifies the affected product, with versions up to 4.9.9.92 reported as vulnerable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates network exploitability requiring low privileges, no user interaction, and low confidentiality, integrity, and availability impact; the assessed CVSS 3.1 vector aligns at 5.3.
Know when Net Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable template input with low complexity but requires a low-privilege account (PR:L); SQLi yields partial read/write/availability impact, kept Low to align with the vendor's conservative impact ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Net Framework
View allMicrosoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameter
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
ASP.NET Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3
Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0
Exploit-DB