{"id":"CVE-2026-40546","state":"PUBLISHED","title":"Multiple SQL Injections in SOPlanning","description":"SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database.\n\nThis issue affects SOPlanning version 1.55 and below.","publishedAt":"2026-06-01T09:04:00.756Z","updatedAt":"2026-06-01T13:03:47.008Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["SOPlanning SOPlanning"],"affected":[{"vendor":"SOPlanning","product":"SOPlanning","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.55","versionType":"semver"}]}],"references":["https://cert.pl/en/posts/2026/06/CVE-2026-40543","https://www.soplanning.org/en/"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/40xxx/CVE-2026-40546.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-40546","state":"PUBLISHED","datePublished":"2026-06-01T09:04:00.756Z","dateUpdated":"2026-06-01T13:03:47.008Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-04-14T09:44:27.613Z"},"containers":{"cna":{"title":"Multiple SQL Injections in SOPlanning","descriptions":[{"lang":"en","value":"SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database.\n\nThis issue affects SOPlanning version 1.55 and below."}],"affected":[{"vendor":"SOPlanning","product":"SOPlanning","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.55","versionType":"semver"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/06/CVE-2026-40543","tags":["third-party-advisory"]},{"url":"https://www.soplanning.org/en/","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-06-01T09:04:00.756Z"},"credits":[{"lang":"en","type":"finder","value":"Łukasz Jaworski"}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-01T13:03:35.590705Z","id":"CVE-2026-40546","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-01T13:03:47.008Z"}}]}}}