CVE-2026-111718

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111718

The AipexBase software (through commit 690adb9 ) is vulnerable to a SQL Injection vulnerability in the /api/data/invoke endpoint. The root cause lies in the order_by and group_by fields, which allow attackers to inject SQL via subqueries or EXTRACTVALUE and UPDATEXML functions. This bypasses the ...

CVE-2026-111718 AipexBase through commit 690adb9 SQL Injection via /api/data/invoke

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

EUVD-2026-103010

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

PT-2026-116117

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order by and group by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...