PT-2026-42885 · Quantumnous · New Api

Eric-E · CVE-2026-9305 · Published 2026-05-23 · Updated 2026-05-23

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2

Description A SQL injection flaw exists in the 'self' Endpoint within the model/topup.go file. The issue is located in the SearchUserTopUps() and SearchAllTopUps() functions, allowing a remote attacker to manipulate queries via SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-9305

Affected Products

New Api

References · 7

• 🔥 https://gist.github.com/YLChen-007/cf501d0a66c81298b2f97e854f3813db · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9305 · Security Note
• https://vuldb.com/vuln/365252/cti · Note
• https://t.me/CVEtracker/54715 · Telegram Post
• https://vuldb.com/vuln/365252 · Note
• https://vuldb.com/submit/812192 · Note
• https://vuldb.com/submit/812195 · Note