Vulnerability DatabaseCVE-2026-94144
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-94144
Published:September 21, 2026
Updated:October 11, 2026
A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related Resources (9)
https://vuldb.com/cve/CVE-2026-94144
https://github.com/drogonframework/drogon/issues/2576
https://github.com/drogonframework/drogon/
https://gist.github.com/2H-K/bf8328f70f72196545b0d9589367cb6a
https://vuldb.com/vuln/408059/cti
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94144.json
https://nvd.nist.gov/vuln/detail/CVE-2026-94144
https://vuldb.com/submit/893929
https://vuldb.com/vuln/408059
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.5
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
7.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Exploit Maturity
PROOF-OF-CONCEPT
Weakness Type (CWE)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89
EPSS
Base Score:
0.43