EUVD-2026-67959
GHSA-84wv-8jqp-6jhr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SQLi with low complexity (PR:N/AC:L/AV:N); full data read and write give C:H/I:H, with A:N as the base treats deletion as integrity rather than availability.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
AnalysisAI
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of IBM Concert (versions 1.0.0 through 2.3.1), per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mostly consistent toward high priority: the CVSS 3.1 base score of 9.1 reflects an unauthenticated, network-facing, low-complexity vector with high confidentiality and integrity impact, which is the classic profile of an easily weaponized SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in IBM's advisory: Patch available per vendor advisory at https://www.ibm.com/support/pages/node/7285337 - upgrade IBM Concert to the IBM-designated fixed release above 2.3.1 (consult the advisory for the exact patched version, which is not restated in the source data, so do not rely on an invented number). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems running IBM Concert versions 1.0.0 through 2.3.1, prioritize any internet-facing instances for immediate remediation, and restrict network access if patch deployment cannot proceed immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan
IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized ac
IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information
IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe
Share
External POC / Exploit Code
Leaving vuln.today