CVE-2026-115332High· 8.8▾ MidnightPoC availableLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptio…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Exploit / PoC code exists
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
lotus <= 0.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115331High· 8.8Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
CVE-2026-115330High· 8.8Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
CVE-2026-115329Medium· 5.9Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
CVE-2017-18362Critical· 9.8ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database