CVE-2026-6093CWE-89sql-injection

CVE-2026-6093

published May 11, 2026

CVSS

6.0

EPSS

Percentile

19.9

In the wild

Unconfirmed

What it is

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.

The record

Technical detail

CVSS: 6.0 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00284 · 19.9th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-05-11T20:17Z

References (4)

https://fluidattacks.com/es/advisories/motley · [email protected]https://github.com/cortezaproject/corteza · [email protected]https://github.com/cortezaproject/corteza/commit/64b58b9d7324e77248bacd183fb994ff338091ec · [email protected]https://fluidattacks.com/es/advisories/motley · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

11 MAY 14:03Z
Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping
cvelistv5