CVE-2026-14029

Name of the Vulnerable Software and Affected Versions Groundhogg — CRM, Newsletters, and Marketing Automation versions prior to 4.5.9

Description An issue exists where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with custom-level access and above to perform SQL Injection. By manipulating the select parameter, an attacker with the view contacts capability can append additional SQL queries to extract sensitive information from the database.

Recommendations Update Groundhogg — CRM, Newsletters, and Marketing Automation to version 4.5.9 or later. Avoid using the select parameter in the affected plugin until the update is applied.