Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity SQL injection with no confirmed auth barrier (PR:N per source, though 'escalate privileges' wording invites verification); full DB read/write yields high C/I/A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
AnalysisAI
SQL injection in WGCLOUD 3.6.4 lets remote attackers inject arbitrary SQL through unsanitized parameters bound in the PortInfoMapper.xml MyBatis mapper, enabling database manipulation that can be leveraged to escalate privileges within the monitoring platform. The flaw is remotely reachable and rated critical (CVSS 9.8), with publicly available exploit code exists in the form of a detailed write-up, though EPSS remains low (0.20%, 10th percentile) and there is no public exploit identified as actively used. WGCLOUD is an open-source IT infrastructure/host monitoring system, so a compromise exposes credentials and monitoring data for every managed host.
Technical ContextAI
WGCLOUD is a Java/Spring-based open-source server and application monitoring suite that uses the MyBatis persistence framework; mapper XML files such as PortInfoMapper.xml define the SQL statements executed against the backing database (commonly MySQL). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) here indicates that user-controlled input reaches a MyBatis statement via string substitution (a ${} binding rather than a parameterized #{} binding), allowing the attacker's input to alter query structure. Because PortInfoMapper handles port-monitoring data typically posted by agents or requested through the web console, the injectable path is exposed over the network. The affected-product CPE was published as a placeholder (cpe:2.3:a:n/a:n/a:*), so exact affected configurations are not machine-enumerated and must be taken from the description (version 3.6.4).
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary action is to consult the WGCLOUD vendor (www.wgcloud.net / the official GitHub project) for a fixed release above 3.6.4 and upgrade once confirmed; do not deploy a version number that is not vendor-confirmed. As compensating controls until a patch is verified: restrict network access to the WGCLOUD web/console and agent-report ports so only trusted management networks can reach the server (this blocks the AV:N path but requires agents to reach the server, so scope allowlists to known agent hosts); place the instance behind a WAF or reverse proxy with SQL-injection filtering on the port-info request parameters (may cause false positives on legitimate monitoring data); and enforce least privilege on the database account used by WGCLOUD so a successful injection cannot read or alter data outside the monitoring schema (limits impact but does not stop the injection). Review the technical details at https://github.com/Y4y17/CVE/blob/main/Wgcloud/SQL-Injection-1.md to build detection signatures for the specific injectable parameter.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today