CVE-2026-50644CWE-89
SQL Injection in SOPlanning Audit Retention Configuration
High · published July 9, 2026
What it is
SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user).
This issue was fixed in version 1.56.01.
The record
Technical detail
- CVSS v4.0
- 8.6 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00469 · 39.6th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2026-07-09T09:57Z
EPSS history
Timeline