CVE-2026-24782CWE-89

Kiteworks Secure Data Forms has a SQL Injection vulnerability

High · published June 1, 2026

CVSS v3.1
7.6
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00667 · 51.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-06-01T22:00Z
EPSS history
Timeline
  • 01 JUN 22:00Z
    Kiteworks Secure Data Forms has a SQL Injection vulnerability
    cvelistv5