Description
WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.
Published: 2026-08-31
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read‑only privileges can inject arbitrary PostgreSQL expressions into the SQL query. This allows the attacker to execute additional statements, bypass host scope restrictions, and retrieve data from other database rows or tables.

Affected Systems

The affected product is Tranquil_IT WAPT Server, versions 2.6.1.17834 and earlier. No other vendor or product versions are reported as affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate‐to‐high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate read‑only account capable of calling the API endpoint, making the attack moderately exploitable but contingent on legitimate authentication.

Generated by OpenCVE AI on August 31, 2026 at 16:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest WAPT Server release that patches the /api/v3/hosts SQL injection flaw
  • Restrict read‑only user accounts from accessing the vulnerable API endpoint or enforce stricter role‑based access controls
  • Monitor API usage logs for anomalous query patterns and perform regular database audits to detect unauthorized data access

Generated by OpenCVE AI on August 31, 2026 at 16:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.
Title WAPT Server SQL Injection via /api/v3/hosts Endpoint
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T15:38:47.425Z

Reserved: 2026-08-17T18:39:57.661Z

Link: CVE-2026-75132

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T16:19:11.070

Modified: 2026-08-31T16:19:11.070

Link: CVE-2026-75132

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T16:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')