EUVD-2026-58875
GHSA-jhw3-xg32-wf56
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQL injection requiring a low-privilege account; high confidentiality via exfiltration, low integrity impact, no availability impact, no scope change.
Primary rating from Vendor (PRJBLK).
CVSS VectorVendor: PRJBLK
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.
AnalysisAI
SQL injection in AppFlowy Cloud's qcuiknote feature enables authenticated users to exfiltrate arbitrary data from the underlying database. Affecting all tracked versions of cpe:2.3:a:appflowy-io:appflowy-cloud, this vulnerability carries a CVSS 4.0 score of 7.1 driven by high confidentiality impact and network reachability at low complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid AppFlowy Cloud user account (authenticated, PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector places this at medium-high severity (7.1) with low attack complexity and no special conditions beyond holding a valid user account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains or already possesses a valid AppFlowy Cloud account at any privilege level. They navigate to the qcuiknote feature and submit a crafted input payload containing SQL metacharacters that break the intended query boundary, appending a UNION-based or stacked query. … |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of AppFlowy Cloud instances across all environments and document version numbers to establish exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today