EUVD-2026-84981
GHSA-wmw4-mw6x-6vfm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with trivial injection (AV:N/AC:L/PR:N/UI:N); column-name injection into read-only LIKE list queries yields data disclosure (C:H) but no confirmed write/DoS (I:N/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. ` article.${key} `). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in ReactPress versions prior to 3.7.0 allows remote attackers to read arbitrary data from the underlying database by supplying crafted query-string parameter names to the API list endpoints for articles, comments, files, knowledge entries, and pages. Because the application interpolates those attacker-controlled names directly as SQL column identifiers while only parameterizing the values, no authentication, user interaction, or non-default configuration is required - any network-reachable ReactPress instance running an affected version is exposed, as reflected in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) and CWE-89 classification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond a network-reachable ReactPress server prior to v3.7.0: exploitation targets the default API list endpoints (article, comment, file, knowledge, page) and requires no authentication, no user interaction, and no non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority vulnerability signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ReactPress to version 3.7.0 or later, which is the vendor-released patch containing the query-column whitelist fix (commit 78ecb70af1c021455c05fdcbe137212c70e310d6); deploy this on every instance because the flaw is reachable unauthenticated over the network on default list endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every ReactPress instance, confirm deployed versions (admin console or deployment artifact), and flag any instance below 3.7.0 as exposed; restrict network reachability of affected instances to trusted networks or place them behind an authenticating reverse proxy if they cannot be patched immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today