CVE-2026-110733

A flaw was found in the Apache SIS SQL storage module. When sorting a stream of features, the application appends sort clauses to database queries after the ORDER BY statement without properly quoting identifier characters. An attacker capable of supplying a crafted sort clause could exploit this...

Apache SIS SQL injection vulnerability

SQL injection vulnerabilities exist in Apache SIS versions 1.0 through 1.6. These vulnerabilities arise because the SQL storage module fails to reference identifier characters in clauses following ORDER BY when sorting feature streams. Specialized sorting clauses can be injected, potentially...