Beveiligingsadvies

CVE-2026-62238

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-17 00:07:12

Laatst bijgewerkt 2026-07-17 10:28:10

Toegewezen door VulnCheck

CVSS-score 7.2

Status PUBLISHED

Beschrijving

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

← Alle CVE's bekijken Bekijk op cve.org ↗