6 matches found
CVE-2026-112341
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...
CVE-2026-112341 Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...
CVE-2026-112341
Wazuh versions from 4.0.0 before 4.14.9 are vulnerable to a SQL injection in the WazuhDBBackend._substitute_params component. The root cause is sequential regex placeholder cross-contamination . Authenticated users with agent:read permissions on a single agent can execute UNION SELECT injections ...
CVE-2026-112341 Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...
EUVD-2026-118284
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...
CVE-2026-112341: wazuh: Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due…
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...