{"id":"CVE-2026-123087","title":"SQL injection in Atmira’s SIREC","summary":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"Atmira","product":"SIREC","affected":["SIREC < 16/10/2026"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T09:30:48.276Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123087","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-atmiras-sirec"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T09:48:47.394Z","epss":0.00251,"epssPercentile":0.16551,"slug":"CVE-2026-123087","body":"## Overview\n\nSQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.\n\n## Affected\n\n- `SIREC < 16/10/2026`\n\n## Remediation\n\nAtmira has confirmed that the vulnerability was fixed on 16 October 2026.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}