CVE-2026-89180

Thinking Software Technology｜EFence - SQL Injection

Published Sep 14, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

Analysis

Technical impact

EFence, developed by Thinking Software Technology, contains a SQL Injection flaw that allows an unauthenticated remote attacker to embed arbitrary SQL commands. The vulnerability can be exploited to read contents from the underlying database, potentially exposing sensitive data. This flaw is an instance of CWE-89 and results primarily in data disclosure rather than modification.

Affected Systems

The affected product is Thinking Software Technology’s EFence. All releases prior to 1.2.67 with database version below 57 are vulnerable. Users should update to EFence 1.2.67 or later, which includes the fix.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. Exploit probability is not documented (EPSS not available) and the vulnerability is not in the CISA KEV catalog. Based on the description, the attack vector is remote and requires no authentication. The lack of authentication requirements combined with the potential to expose database content makes this a significant risk for any installation exposed to the network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Thinking Software Technology

EFence

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2.65 DB Ver:55

No data.

Vendor Product Versions

Thinkingsoftware

Efence

Version	Status	Scheme	Platform
`[0,1.2.65 DB Ver:55]`	affected	generic	—

Remediation

Vendor Solution

Please update to 1.2.67 DB Ver:57 or later

OpenCVE Recommended Actions

Upgrade EFence to version 1.2.67 or later, which patches the SQL injection vulnerability.
Restrict network access to EFence user interfaces to trusted IP ranges or via firewall rules to limit exposure to unauthenticated remote attacks.
Implement input validation and enforce the use of parameterized queries or prepared statements to prevent inadvertent SQL injection, and monitor database logs for anomalous queries.

Generated by OpenCVE AI on September 15, 2026 at 14:40 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.563% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-11203-26db2-2.html
https://www.twcert.org.tw/tw/cp-132-11202-48c1b-1.html

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Thinkingsoftware Thinkingsoftware efence
Vendors & Products		Thinkingsoftware Thinkingsoftware efence

Sep 14, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 10:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
Title		Thinking Software Technology｜EFence - SQL Injection
Weaknesses		CWE-89
References		https://www.twcert.org.tw/en/cp-139-11203-26db2-2.html https://www.twcert.org.tw/tw/cp-132-11202-48c1b-1.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`