CVE-2026-28516

OpenDCIM 23.04 (commit 4467e9c4) contains a SQL injection in Config::UpdateParameter. install.php and container-install.php interpolate user input into SQL without prepared statements, allowing an authenticated user to execute arbitrary SQL against the database. The vulnerability is documented as...