CVE-2026-2094
8.8 HIGHPublished 2026-02-10 · Modified 2026-02-10 · Received
Quick Summary
Docpedia, a software by Flowring, has a critical flaw that lets logged-in attackers send malicious database commands. This matters because it directly threatens the security of all information stored in the application.
Who is affected
All users running a vulnerable version of Docpedia are affected. An attacker could steal, change, or erase any data in the database.
Recommended fix
Immediately apply any security patches provided by Flowring. If a patch is not available, implement strict input validation and use parameterized queries to mitigate the SQL injection risk.
Technical Description
Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Details
Attack Vector
NETWORK
Complexity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-89