CVE-2026-24782
High · 7.6CVSS
7.6
EPSS
0.7%
Published
Jun 1, 2026
CISA due date
—
The record
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
- CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
- CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
- CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
- CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
- CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
- CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
- CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89