GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

EUVD-2026-94522

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...