CVE-2026-116818
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through
CVSS
8.2
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 27 oct 2026 · Última mod.: 27 oct 2026 · CWE-89
Sin historial EPSS suficiente todavía.
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
- github.comhttps://github.com/Openpanel-dev/openpanel/commit/35ddc8ebbcd4ed0767933de61f014f153d68442a
- github.comhttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-8wr9-x797-f238
- www.vulncheck.comhttps://www.vulncheck.com/advisories/openpanel-before-3.0.0-unauthenticated-clickhouse-sql-injection-via-live-visitors-websocket
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1168284.9 MED—
———YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.7hCVE-2026-1168216.5 MED—
———YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.7hCVE-2026-1168136.5 MED—
———OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.7hCVE-2026-1168126.5 MED—
———OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.7hCVE-2026-1168087.2 ALT—
———OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.7hCVE-2026-1168076.5 MED—
———OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.7h