CVE-2026-110265
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121731 RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated… CWE-89
- CVE-2026-121524 A flaw has been found in sumiie24 School-Management-System up to… CWE-89
- CVE-2026-121502 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. CWE-89
- CVE-2026-45146 Chamilo LMS is an open-source learning management system. CWE-89
- CVE-2026-44265 Elo is a purely functional expression language for no-code tools. CWE-89
- CVE-2026-109594 Post-authentication Improper Neutralization of Special Elements used in an SQL Command… CWE-89
- CVE-2026-65139 NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD… CWE-89
- CVE-2026-120558 The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL… CWE-89