What is the CVSS score of CVE-2026-2094?

CVE-2026-2094 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-2094?

Within 24 hours: Identify all Docpedia instances in production and document user access logs for the past 30 days to detect suspicious activity. Within 7 days: Implement network segmentation to restrict Docpedia database access and deploy WAF rules to block SQL injection patterns; disable non-essential Docpedia features if possible. Within 30 days: Conduct a database audit for unauthorized modifications, evaluate alternative solutions, and establish a communication channel with Flowring for patch ETA.

CVE-2026-2094

HIGH

SQL Injection (CWE-89)

2026-02-10 twcert@cert.org.tw

SQLi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 07:16 nvd

HIGH 8.8

DescriptionCVE.org

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

AnalysisAI

Docpedia by Flowring contains a SQL injection vulnerability (CWE-89) that allows authenticated users to execute arbitrary database queries with network access. Attackers can exploit this flaw to read, modify, or delete sensitive database contents, with no patch currently available. The vulnerability has a high CVSS score of 8.8 and affects all confidentiality, integrity, and availability of the underlying database.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Affected ProductsAI

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, mo

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.