PT-2026-121369

CVE-2026-115331

·

Published

2026-10-22

·

Updated

2026-10-22

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-115331
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com