CVE-2026-6629

Name of the Vulnerable Software and Affected Versions MetaCRM versions prior to 6.4.1

Description An issue exists in the Interface component within the sql.jsp file. Remote manipulation of the sql argument passed to the Statement.executeUpdate() function allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the sql.jsp file or avoid using the sql argument in the affected component.