PT-2026-56774 · Soplanning · Soplanning

Arkadiusz Marta · Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-50644

NVD

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user).

This issue was fixed in version 1.56.01.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-50644

Produtos afetados

Soplanning

Referências · 3

• https://soplanning.org/en · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-50644 · Nota de Segurança
• https://cert.pl/en/posts/2026/07/CVE-2026-50644 · Nota