CVE-2026-40546CWE-89
Multiple SQL Injections in SOPlanning
High · published June 1, 2026
What it is
SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database.
This issue affects SOPlanning version 1.55 and below.
The record
Technical detail
- CVSS v4.0
- 8.7 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00358 · 28.3th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2026-06-01T09:04Z
EPSS history
Timeline