CVE-2026-123087

SQL injection vulnerability in Atmira’s SIREC

Risk score: 52/100
CVSS: 8.7 v4.0
Published: 6 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to ret…
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.7 high

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-atmiras-sirec

Original description

SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

Last activity 6 Nov 2026. Patch Forecast updates every hour.