CVE-2026-23696
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality
CVSS
9.9
Critical
EPSS
13.6%
p96
KEV
—
Exploit Today
29
0-100
Published: Apr 7, 2026 · Last modified: Jul 14, 2026 · CWE-89
13.6%EPSS · 30 days13.6%
2026-09-272026-10-25
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.
- apps.nextcloud.comhttps://apps.nextcloud.com/apps/flow/releases
- chocapikk.comhttps://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/
- github.comhttps://github.com/Chocapikk/Windfall
- github.comhttps://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe
- github.comhttps://github.com/windmill-labs/windmill/releases/tag/v1.603.3
- www.vulncheck.comhttps://www.vulncheck.com/advisories/windmill-file-ownership-handling-sqli-rce
- www.windmill.devhttps://www.windmill.dev/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1159488.5 HIG—
——0Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.4hCVE-2026-1156088.5 HIG—
——0Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.4hCVE-2026-1161127.3 HIG—
——0A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.12hCVE-2026-1161016.3 MED—
——0A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.14hCVE-2026-1160627.3 HIG—
——0A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.21hCVE-2026-1160617.3 HIG—
——0A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.21h