CRITICAL 9.4 NVD

CVE-2026-89310

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

References

https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310

Published: 2026-10-14 · Source: NVD · Feed updated: 2026-10-14

This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-10-14 via NVD.

Risk Timeline

CVE Disclosed2026-10-14 · -1 days ago

Remediation Resources

Official Advisory

www.jtl-software.com/de/cve-2026-89309-cve-2026-89310

vulnfeed aggregates 14664 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.