CVE-2026-13766

DBIx::QuickORM for Perl versions before 0.000026 is vulnerable to SQL injection via unquoted SQL identifiers. The default SQL builder (a SQL::Abstract subclass) does not set quote_char, causing caller-supplied identifiers (e.g., order_by, where clause keys, join aliases, and upsert columns) to be...