CVE-2026-40546

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/06/CVE-2026-40543
https://www.soplanning.org/en/

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) SOPlanning es vulnerable a inyección SQL a través de múltiples puntos finales y parámetros. Atacante con privilegios bajos puede inyectar comandos SQL arbitrarios, lo que podría resultar en el control total sobre la base de datos. Este problema afecta a SOPlanning versión 1.55 e inferiores.

01 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 09:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-40546

Mitre link : CVE-2026-40546

CVE.ORG link : CVE-2026-40546

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-40546", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40546", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-01T13:03:35.590705Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "SOPlanning", "product": "SOPlanning", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.55"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-01T09:16:17.400", "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-40543", "source": "cvd@cert.pl"}, {"url": "https://www.soplanning.org/en/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database.\n\nThis issue affects SOPlanning version 1.55 and below."}, {"lang": "es", "value": "SOPlanning es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de m\u00faltiples puntos finales y par\u00e1metros. Atacante con privilegios bajos puede inyectar comandos SQL arbitrarios, lo que podr\u00eda resultar en el control total sobre la base de datos.\n\nEste problema afecta a SOPlanning versi\u00f3n 1.55 e inferiores."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cvd@cert.pl"}