CVE-2026-115330High· 8.8▾ TwilightLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL thr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
lotus <= 0.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115331High· 8.8Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
CVE-2026-115332High· 8.8Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
CVE-2026-115329Medium· 5.9Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0