CVE-2026-52673

SQL Injection in Cboard getDimensionsValues Component Enabling Remote Code Execution

View on CVE.org
Published Jun 23, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component

Analysis

AI-generated

Technical impact

The vulnerability is a Classic SQL Injection flaw (CWE-89) in the getDimensionsValues component of Cboard that permits a remote attacker to run arbitrary SQL commands, potentially leading to code execution on the underlying system.

Affected Systems

Cboard version 0.4.2 and all earlier releases are affected; vendor information is not disclosed.

Risk and Exploitability

With a CVSS score of 6.5 the risk is moderate and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the unsecured getDimensionsValues endpoint, requiring the attacker to craft a specially crafted request that injects malicious SQL.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent Cboard patch or upgrade to the latest supported version that removes the vulnerable code.
  • Restrict external access to the getDimensionsValues endpoint by firewall rules or by requiring authenticated sessions.
  • Ensure that all user input reaching database queries is properly parameterized or escaped to eliminate injection vectors.

Generated by OpenCVE AI on June 24, 2026 at 11:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Cboard
Cboard cboard
Vendors & Products Cboard
Cboard cboard
Type Values Removed Values Added
Title SQL Injection in Cboard getDimensionsValues Component Enabling Remote Code Execution
Type Values Removed Values Added
Title Cboard getDimensionsValues SQL Injection Enables Remote Code Execution
Type Values Removed Values Added
Title Cboard getDimensionsValues SQL Injection Enables Remote Code Execution
Type Values Removed Values Added
Title SQL Injection in Cboard getDimensionsValues Enables Remote Code Execution
Type Values Removed Values Added
Title SQL Injection in Cboard getDimensionsValues Enables Remote Code Execution
Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component
References
Earlier changes (4)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jul 5, 2026, 1:36 AM
Reserved
Jun 8, 2026, 12:00 AM

View source JSON

Updated
Jun 23, 2026, 3:54 PM

JSON

Status
Deferred
Published
Jun 23, 2026, 4:17 PM
Modified
Jul 5, 2026, 2:17 AM

View source JSON

No data.

Updated
Jun 24, 2026, 4:07 PM

JSON