CVE-2026-112341Medium· 6.5▾ SunlitWazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.
wazuh >= 4.0.0 < 4.14.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112334Medium· 4.9Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
CVE-2026-112335Medium· 5.5Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
CVE-2026-112336Medium· 6.5Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
CVE-2026-112337Low· 3.7Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination
CVE-2026-112338Medium· 5.9Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
CVE-2026-112339Medium· 5.9Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module