Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-28443

OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openreplay openreplay

  • < 1.20.0affected

References