PT-2026-40809 · Misp · Misp

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-44381

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.37

Description An issue exists in the handling of user-controlled ordering parameters within the event and shadow attribute listing endpoints. The software accepts order or sort values from request parameters and incorporates them into database query ordering clauses without sufficient validation of the requested field name. This allows an attacker to craft a malicious ordering parameter to manipulate the generated SQL query, which could lead to unauthorized data access or modification of query behavior depending on database permissions.

Recommendations Update to version 2.5.37.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44381

Affected Products

Misp

References · 3

• https://github.com/MISP/MISP/security/advisories/GHSA-4cxp-22wm-j6jr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44381 · Security Note
• https://twitter.com/CVEnew/status/2054709209263157302 · Twitter Post