CVE-2026-111634
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated…
- Risk score
- 52/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables a…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
- https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
- https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
Original description
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
Last activity 16 Oct 2026. Patch Forecast updates every hour.