PT-2026-23518 · Unknown · Openreplay

Q1Uf3Ng · Published 2026-03-05 · Updated 2026-03-25 · CVE-2026-28443

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenReplay versions prior to 1.20.0

Description OpenReplay is a self-hosted session replay suite. The /{projectId}/cards/search API endpoint has a SQL injection issue in the sort.field parameter for versions before 1.20.0. The issue allows for potential unauthorized database access or modification through manipulation of the sort.field parameter in the specified API endpoint.

Recommendations Update to version 1.20.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28443

GHSA-Q6GF-3QG3-PWW5

Affected Products

Openreplay

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28443.json · Exploit
• https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28443 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28443 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2029681921056276756 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/CVEnew/status/2030385206905966690 · Twitter Post