CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2023-52290

The streampark-console component (versions prior to 2.1.4 ) is vulnerable to SQL injection due to a lack of validation on the sort field sent from the front-end. Because the back-end uses this unvalidated field directly to generate SQL queries, an authenticated attacker can execute arbitrary quer...