CVE-2026-64880
Blind SQL Injection
At a glance Severity HIGH 7.1 EPSS EPSS 0.32 % · percentile 24 (2026-10-27) State PUBLISHED Published 2026-07-21 Updated 2026-07-22 Assigner tenable NVD status Analyzed Description Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N tenable CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N tenable CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · vulnreport@tenable.com (Secondary) CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N NVD · vulnreport@tenable.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:* ≥ 6.6.0 ≤ 6.8.0Affected products
References
Sources
