{"id":"CVE-2026-89310","published":"2026-10-14T07:17:04.650","lastModified":"2026-10-16T20:04:29.760","description":"A parameter taken from the request body is inserted into\na T-SQL statement without parameterization or escaping, allowing\na remote attacker to execute arbitrary SQL statements in the context of the\napplication's database account.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in the application's database handling where user-supplied parameters from request bodies are directly inserted into T-SQL statements without proper escaping or parameterization, allowing attackers to execute arbitrary SQL commands with the privileges of the database account.","exploitability":"Exploitation is relatively straightforward for a remote attacker who can submit crafted requests to the vulnerable endpoint, requiring only basic SQL injection techniques and no additional authentication or complex preconditions.","blast_radius":"The impact could be severe across the entire application's data access layer, potentially allowing attackers to read, modify, or delete sensitive data, escalate privileges, or even execute system commands through database-level operations.","remediation":"Immediate remediation requires upgrading to version 2.590 or later where this SQL injection vulnerability has been patched.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","rce"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:46:29.986Z"}}