CVE-2026-2093

Vulnerability

Overview

Docpedia 3.0, developed by Flowring, is affected by a SQL injection vulnerability (CVE-2026-2093). The flaw exists in an unspecified input parameter that fails to properly sanitize user-supplied data before incorporating it into SQL queries. This allows an attacker to inject arbitrary SQL commands [1][2].

Attack

Vector

The vulnerability can be exploited remotely without any authentication. The attacker only needs network access to the Docpedia's web interface. No special privileges or user interaction are required, making the attack surface broad and easily accessible [1][2].

Impact

Successful exploitation enables an unauthenticated attacker to read arbitrary data from the database. This could include sensitive information such as user credentials, personal data, or other confidential records. The CVSS v3.1 score is 7.5 (High), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no direct impact on integrity or availability [1][2].

Mitigation

Flowring has released a patch, DP4 HotFix_057, to address this vulnerability. Users are strongly advised to apply the patch immediately. No workarounds are mentioned in the advisory [1][2].