JSON path injection via unescaped get_path segments in AshSqlite
CVSS Skor
2.1
EPSS İhtimal
%0.2
Risk Skoru
0.0
Yayın
1 ay önce
İlgili Siber Güvenlik Haberleri (Newsroom)
Bu zafiyetin basında ve siber güvenlik yayın organlarında yer aldığı makaleler ve analiz bültenleri:
PaperCut Issues Second Emergency Patch as Researchers Break Fix for Exploited Zero-Days
PaperCut released a second emergency patch last Friday, for two vulnerabilities in its NG and MF print management servers that attackers are already exploiting, after security researchers demonstrated that the vendor's first fix could be bypassed. The two flaws work as a chain. CVE-2026-81578, rated 8.8 on the CVSS scale, is an improper access control weakness in the PaperCut web management interface that lets unauthenticated remote requests reach administrative functions before the server finishes validating access. CVE-2026-82078, rated 9.4, is an unsafe dynamic class-loading flaw in the pro
AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Fields
CVE-2026-77846, a newly disclosed AshSqlite vulnerability, can allow attackers to access hidden or sensitive fields stored inside JSON and map columns when applications pass untrusted input to AshSqlite's get_path/2 functionality. The Erlang Ecosystem Foundation's CNA issued the vulnerability entry on August 30, 2026. The issue affects AshSqlite, the SQLite data layer used by the Ash Framework. Although it involves database queries, CVE-2026-77846 is not SQL injection. Instead, the AshSqlite vulnerability results from unsafe construction of JSON paths and the way SQLite interprets special char
İlgili Benzer Açıklar
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-77846"