Which versions of Aix Db are affected by EUVD-2026-14262?

Organizations using apconw Aix-DB should be aware of moderate risk from CVE-2026-4530, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for EUVD-2026-14262?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14262. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14262?

Within 30 days: Identify affected systems running apconw Aix-DB and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Aix Db EUVD-2026-14262

Q: What is the CVSS score of EUVD-2026-14262?

EUVD-2026-14262 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4530 LOW

SQL Injection (CWE-89)

2026-03-21 VulDB

GHSA-3p66-hvjq-gcvr

SQLi Aix Db

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

5.3 (MEDIUM) 4.8 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 23:45 euvd

EUVD-2026-14262

Analysis Generated

Mar 21, 2026 - 23:45 vuln.today

CVE Published

Mar 21, 2026 - 23:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Performing a manipulation of the argument Description results in sql injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in apconw Aix-DB through the terminology_retriever.py module allows local attackers to manipulate the Description argument and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. Affected versions include Aix-DB up to 1.2.3.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw. The affected product is apconw Aix-DB (CPE: cpe:2.3:a:apconw:aix-db:*:*:*:*:*:*:*:*), a database abstraction or query generation tool that includes a natural language-to-SQL conversion module (text2sql). The terminology_retriever.py component within the RAG (Retrieval-Augmented Generation) pipeline fails to properly sanitize or parameterize user-supplied Description input before incorporating it into SQL queries. This allows an attacker to break out of intended query context and execute arbitrary SQL operations. The vulnerability affects all versions up to and including 1.2.3, suggesting no patched version has been released or publicly disclosed.

RemediationAI

Immediate action: upgrade to any version of apconw Aix-DB released after 1.2.3 if available; however, given the vendor's non-responsiveness, verify any upgrade with apconw directly or review GitHub/security advisory channels. Primary workaround pending patch availability: implement input validation and sanitization at the application layer before passing any user-supplied Description parameters to the terminology_retriever module—specifically, enforce parameterized query construction and reject or escape SQL metacharacters. Network segmentation is critical: restrict local access to the Aix-DB instance to trusted processes and users only, leveraging OS-level access controls and database authentication enforcement. Consider disabling or isolating the text2sql/RAG functionality if it is not essential to your workload. Monitor database logs and query patterns for signs of SQL injection attempts. Until the vendor releases a patch or an alternative is found, treat Aix-DB as high-risk in any security-sensitive context and prioritize migration to a maintained alternative if possible.