PT-2026-2104 · Unknown · Tarkov Data Manager

Sut0L · Published 2026-01-07 · Updated 2026-02-03 · CVE-2026-21856

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tarkov Data Manager versions prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8

Description The Tarkov Data Manager is a tool used to manage Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time-based blind SQL injection issue exists in the webhook edit and scanner API endpoints. An authenticated attacker can exploit this to execute arbitrary SQL queries against the MySQL database. The vulnerable API endpoints are susceptible due to a flaw that allows manipulation of database queries through time-based inference.

Recommendations Update to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 or a later version to resolve this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-21856

GHSA-4GCX-GHWC-RC78

Affected Products

Tarkov Data Manager

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21856.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-21856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21856 · Security Note
• https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-4gcx-ghwc-rc78 · Note
• https://github.com/the-hideout/tarkov-data-manager/commit/9bdb3a75a98a7047b6d70144eb1da1655d6992a8 · Note
• https://twitter.com/VulmonFeeds/status/2009062923809731000 · Twitter Post
• https://t.me/cveNotify/150746 · Telegram Post
• https://t.me/CVEtracker/41636 · Telegram Post
• https://twitter.com/CVEnew/status/2009020533749502209 · Twitter Post