PT-2026-23518

CVE-2026-28443

Published

2026-03-05

Updated

2026-03-25

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenReplay versions prior to 1.20.0

Description OpenReplay is a self-hosted session replay suite. The /{projectId}/cards/search API endpoint has a SQL injection issue in the sort.field parameter for versions before 1.20.0. The issue allows for potential unauthorized database access or modification through manipulation of the sort.field parameter in the specified API endpoint.

Recommendations Update to version 1.20.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Q1Uf3Ng

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers