CVE-2026-111634

8.1 Élevée

Publiée le 16/10/2026 à 20:17 · Modifiée le 21/10/2026 à 23:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.

Traduire en français

Produits concernés

helicalinsight

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.6 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	8.1 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-89

Références

https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235
https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource
https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories