MEDIUM

CVE-2026-52673

2026-06-23 CVSS v3.1

CVSS

6.5

Description

SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component

Summary dbcve.org

A SQL Injection vulnerability exists in the getDimensionsValues component of Cboard v0.4.2 and prior versions. An attacker can exploit this flaw by injecting malicious SQL queries through unsanitized input, potentially allowing unauthorized data access or remote code execution depending on the database configuration.

Mitigation

Upgrade to a version beyond v0.4.2 that includes patched SQL handling, and implement parameterized queries/Prepared Statements for the getDimensionsValues component and similar user-input-driven database queries.

Weakness (CWE)

CWE-89 SQL Injection

EPSS Score

0.6%

Probability of exploitation in next 30 days

47.4th percentile

References

https://gist.github.com/onehang01/93d233a8aef2fc73294c25db8ca3b424 https://www.chuguotech.com/#/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE