CVE-2026-115330
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by append
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 22, 2026 · Last modified: Oct 22, 2026 · CWE-89
Not enough EPSS history yet.
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
- github.comhttps://github.com/uselotus/lotus
- github.comhttps://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656
- hackmd.iohttps://hackmd.io/@leediay/BkUc3WL2Mx
- www.vulncheck.comhttps://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1153328.8 HIG—
———Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.7hCVE-2026-1153318.8 HIG—
———Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.7hCVE-2026-1153288.8 HIG—
———JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.7hCVE-2026-1153248.1 HIG—
———mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.7hCVE-2026-1128228.5 HIG—
———Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.3hCVE-2025-714348.2 HIG—
———Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.7h